Does an image showing exception error on my site pose a prominent security risk?

Question

I wrote a small website in PHP and ZF2.

Had a friend test it out by posting a link to it on Facebook.

Apparently I forgot to turn off ZendFramework reporting and he find an error. Posted a photo of the error.

In the photo it is exposed that I'm using ZF2 and my account's username, and paths to error exposing ZF2 file location.

/home/user/public_html, things like that

Example

An error occurred
Additional information:
Zend\Mail\Transport\Exception\RuntimeException
File:
/home/username/public_html/domain.net/vendor/zendframework/zend-mail/src/Transport/Sendmail.php:290
Message:
Unable to send mail: 
Stack trace:
#0 [internal function]: Zend\Mail\Transport\Sendmail->mailHandler('mail <mail@mail...', 'Your ...', 'Your Commission...', 'Date: Sat, 21 M...', ' -fservice@mail...')
#1 /home/username/public_html/domain.net/vendor/zendframework/zend-mail/src/Transport/Sendmail.php(138): call_user_func(Array, 'mail <mail@mail...', 'Your ...', 'Your Commission...', 'Date: Sat, 21 M...', ' -fservice@mail...')
#2 /home/username/public_html/domain.net/module/Commission/src/Mail/Mail.php(22): Zend\Mail\Transport\Sendmail->send(Object(Zend\Mail\Message))

(username and domain and emails in message above are altered)

Is the text on the photo endangering my security?

Do I ask him to take it down?

Answer 1

You shouldn't show exceptions to users, and it does have a slight impact on security.

I'm assuming that you disabled exceptions, and are now worried about the data that is leaked via the screenshot:

Leaked Username

Usernames aren't generally considered sensitive information.

You may still want to keep it secret as defense in depth, to make some attacks such as bruteforce, phishing, or privilege escalation more difficult, but leaking a username is generally not considered a security issue.

Leaked absolute Paths

Full Path Disclosure may:

• aid in the exploitation of LFI vulnerabilities. [Although an attacker may be able to exploit LFI without knowing the absolute path, or may guess the correct path themselves.]
• provide information about the operating system. [This may help in discovering further vulnerabilities, or may aid in the exploitation of other existing vulnerabilities.]
• leak system usernames. [see above.]
• leak names of secret public directories and thus lead to disclosure of sensitive information. [although you shouldn't rely on the secrecy of a publicly accessibly directory to protect you; security through obscurity shouldn't be your main line of defense.]

Conclusion

On it's own, it is very unlikely that the leaked information can be used to start an attack. However, it may make other existing vulnerabilities slightly easier to exploit or aid in finding further vulnerabilities.

It is generally preferred to keep this information private, so you may want to change your username as well as the paths, but if it is not easily doable, the security of your server will not be severely impacted if you don't.

Answer 2

Generally, those errors are really useful when an attacker is trying to compromise the site. In your case it isn't something fancy, the only attack vector I see is brute-force/dictionary attack, since the error exposed your username.