Our web application has an error page that displays the absolute URL path and query of the page on which the error occurred, the date/time of the error, and the exception message. (We do not display the stack trace. That is an obvious vulnerability.)
Is it a vulnerability to display exception messages in an error page?
For maximum security, what should we display in an error page? What should we not display?
EDIT: My hunch is that it is a vulnerability, but I want to hear an expert opinion.
In some cases, error messages induce vulnerabilities. In the area of cryptography, the padding oracle attack can recover a secret key by sending altered encrypted messages, and using an "oracle" which distinguishes between two kinds of failure ("padding was wrong" vs "there was a valid padding, but the resulting data was gibberish"). Detailed error messages have a strong potential for being such an oracle. In a more general, conceptual view, attackers will try to uncover weaknesses by prodding at the system and observing what happens, and more data can only help them. The exception message is not qualitatively distinct from the stack trace, in that respect; so if the stack trace is an "obvious" vulnerability, so must be the exception message too.
Path disclosure / path leakage can also be used to fingerprint apps and their underlying servers, in addition to providing enumeration of attack surface. Nearly every web application that utilizes dynamic pages will leak local web server paths, sometimes which contain usernames and obviously vulnerable directories.
They can also be leveraged during file inclusion or script inclusion attacks. Special care must be made for PHP/CTP, ASP/ASPX, and JSP/JSPX files in order to prevent path disclosure messages from being easily turned into a file inclusion attack, which can (for example) read local files.
I wouldn't necessarily call it a vulnerability in itself. The exception alone probably isn't enough to breach the security of your server.
But it is a weakness that might reveal information that helps attackers, or gives them a foot in the door. For instance, it might reveal information about the code or software version. It might make it easier for attackers to try attacks and learn about how to tweak them to make them work.
Also, sometimes attackers are able to put together several weaknesses and combine them to build a full exploit. No one weakness on its own is a vulnerability, i.e., no one weakness on its own would allow attackers to breach the security of your system. But when attackers combine them in a clever way, sometimes they provide enough stepping stones to allow a full-fledged security breach.
For these reasons, I'd be inclined to be cautious about these kinds of "weaknesses". It seems safer to try to avoid them, if you can.
