CAS-005 · Question #296
A security analyst is performing a review of a web application. During testing as a standard user, the following error log appears: Error Message in Database Connection Connection to host USA-WebApp-D
The correct answer is C. The findings indicate information disclosure. The displayed error message should be modified.. Revealing internal hostnames, database names, and table names in user-facing error messages leaks sensitive implementation details that aid attackers. To mitigate this, the application should catch such exceptions and return a generic, user-friendly error (e.g. “An internal error
Question
A security analyst is performing a review of a web application. During testing as a standard user, the following error log appears:
Error Message in Database Connection Connection to host USA-WebApp-Database failed Database "Prod-DB01" not found Table "CustomerInfo" not found Please retry your request later Which of the following best describes the analyst's findings and a potential mitigation technique?
Options
- AThe findings indicate unsecure references. All potential user input needs to be properly sanitized.
- BThe findings indicate unsecure protocols. All cookies should be marked as HttpOnly.
- CThe findings indicate information disclosure. The displayed error message should be modified.
- DThe findings indicate a SQL injection. The database needs to be upgraded.
How the community answered
(53 responses)- A4% (2)
- B6% (3)
- C75% (40)
- D15% (8)
Explanation
Revealing internal hostnames, database names, and table names in user-facing error messages leaks sensitive implementation details that aid attackers. To mitigate this, the application should catch such exceptions and return a generic, user-friendly error (e.g. “An internal error occurred, please try again later”) while logging the full details only on the server side.
Community Discussion
No community discussion yet for this question.