Explaining information leak to Lead dev

Question

Our lead dev tells me that this information leak from our website is "no vulnerability. Just an ugly error UI." It looks to me that the leaked information could be used to aid an attack.

Does it provide a security risk?
If so, how can I explain this to the lead dev and advice on providing a fix?

Much appreciated.

PS: (Apologies for not copy and pasting the message. I did a screenshot and couldn't reproduce the error easily. Please click on the image to see it enlarged.)

Answer 1

Any information about the internals of a system or application helps an attacker craft a specific attack. For instance, that error message includes table names, which means it becomes far easier to craft a SQLi attack.

In addition, with detailed error messages, I could try to trigger different errors to map out the function of the backend, and even find vulnerabilities much faster.

In general, detailed error messages are a no-no. Use them only on a QA instance for debugging.

That said, there is a reason why "info disclosure" is not regarded as an automatic "high" finding. It is possible that even the details of the application or system would not help an attacker, but that is up to each and every system. So, the risk needs to be evaluated in each instance (which doesn't provide you with a quick answer to your lead dev).

As an evaluator, though, when I see highly detailed error messages like the one you posted, I know that the devs have not been careful, and I can assume that the application is not properly coded, and likely with a lot of vulnerabilities. In short, if I see a message like that, I pull out all the guns to find the holes there are likely to be, and I have all the details I need to precisely exploit them.

Answer 2

It does provide a security risk, though it may not be a huge one.

What that shows is actual code, which reveals:

• The language your backend uses (at least I hope that's your backend code - if you're doing a database query on the client side, you'd be revealing far too much information to them), and possibly some of the libraries that you're using. Depending on the specifics, there may be some unpatched vulnerability that a skilled attacker can find to try against you with that knowledge. Now, to be fair, hiding this information is security by obscurity, but as a general rule, you never want to reveal more than you have to.
• From the look of it, part of the structure of your database(s). This is more information that they have no business knowing, and nothing good can come of it. It may help them perform an injection attack, for instance.

Now, is this a huge risk? Only you can evaluate this, based on your situation. It could be that even if they compromise your entire system, you don't care, but it should still be addressed. Even if there's no real damage they could do to you, it looks unprofessional and reflects poorly on you.