1. Executive Summary & Scope
Verbose error messages that reveal stack traces, database server types, internal directory paths, and source code excerpts provide attackers with reconnaissance data needed to develop reliable exploits against the target infrastructure.
Standard Classification
OWASP Standard: OWASP Top 10 • Mapping: CWE-209 • Target Architecture: Public Web Systems & APIs
2. Threat Model & Attack Vectors
An attacker triggers an intentional database exception (e.g. malformed JSON or type error) to reveal the absolute server file paths, database username, and exact ORM framework version.
3. Code Analysis & Remediation Playbook
Vulnerable Implementation Pattern
// VULNERABLE: Exposing raw exception details in production HTTP response
try {
$db->connect();
} catch (\Exception $e) {
// Insecure: Dumps full file path, credentials, and stack trace to user!
die("Database Connection Error: " . $e->getMessage() . "\n" . $e->getTraceAsString());
}
Hardened Defense-in-Depth Implementation
// REMEDIATED: Generic client response with server-side correlation ID
try {
$db->connect();
} catch (\Throwable $e) {
$errorReference = bin2hex(random_bytes(8));
// Log complete diagnostics server-side only
error_log("[ERROR REF: $errorReference] " . $e->getMessage() . " in " . $e->getFile() . ":" . $e->getLine());
// Return sanitized generic error message with support reference
http_response_code(500);
echo json_encode([
'error' => 'An internal server error occurred',
'reference_code' => $errorReference
]);
exit;
}
4. Audit Verification Checklist & Pass Criteria
| Verification Phase | Audit Test Description | Mandatory Passing Criteria |
|---|---|---|
| Malformed Input Injection | Submit invalid JSON, type-mismatched parameters, and non-numeric IDs. | Server returns clean JSON error or custom 400/500 template with zero stack traces. |
| PHP Configuration Verification | Verify `display_errors = Off` in active `php.ini` configuration. | `phpinfo()` confirms `display_errors` is disabled in production. |
| Custom HTTP Error Pages | Inspect HTTP 404, 500, and 502 responses. | Responses render standard WebOTG branded error layout without web server version headers. |
Advertisement
WE
WebOTG Application Security Directorate
Senior Security Auditor
WebOTG provides benchmark reference documentation, automated matrix evaluators, and security test harnesses for government digital platforms, WQMS architectures, and STQC compliance frameworks.