Uncaught Exception in Servlet
Draft Variant
Structure: Simple
Description
The Servlet does not catch all exceptions, which may reveal sensitive debugging information.
When a Servlet throws an exception, the default error response the Servlet container sends back to the user typically includes debugging information. This information is of great value to an attacker. For example, a stack trace might show the attacker a malformed SQL query string, the type of database being used, and the version of the application container. This information enables the attacker to target known vulnerabilities in these components.
Common Consequences 1
Scope: ConfidentialityAvailability
Impact: Read Application DataDoS: Crash, Exit, or Restart
Potential Mitigations 1
Phase: Implementation
Implement Exception blocks to handle all types of Exceptions.
Demonstrative Examples 1
ID : DX-39
The following example attempts to resolve a hostname.Code Example:
Bad
Java
javaA DNS lookup failure will cause the Servlet to throw an exception.
Modes of Introduction
Implementation
Alternate Terms
Missing Catch Block
Related Weaknesses
Taxonomy Mapping
- The CERT Oracle Secure Coding Standard for Java (2011)
- Software Fault Patterns
Notes
MaintenanceThe "Missing Catch Block" concept is probably broader than just Servlets, but the broader concept is not sufficiently covered in CWE.