1.CWE解析
下面是CWE-209 信息的解析 包含 威胁名称 、相关弱点、常见后果、检测方法、缓解措施、例子和 条目更改的信息等。
<Weaknesses><Weakness ID="209" Name="Information Exposure Through an Error Message" Abstraction="Base" Structure="Simple" Status="Draft"> [弱点元信息]<Description>The software generates an error message that includes sensitive information about its environment, users, or associated data.</Description> [弱点描述]<Extended_Description>The sensitive information may be valuable information on its own (such as a password), or it may be useful for launching other, more deadly attacks. If an attack fails, an attacker may use error information provided by the server to launch another more focused attack. For example, an attempt to exploit a path traversal weakness (CWE-22) might yield the full pathname of the installed application. In turn, this could be used to select the proper number of ".." sequences to navigate to the targeted file. An attack using SQL injection (CWE-89) might not initially succeed, but an error message could reveal the malformed query, which would expose query logic and possibly even passwords or other sensitive information used within the query.</Extended_Description> [额外描述]<Related_Weaknesses>[相关的弱点]<Related_Weakness Nature="ChildOf" CWE_ID="200" View_ID="1000" Ordinal="Primary"/> <Related_Weakness Nature="ChildOf" CWE_ID="200" View_ID="699" Ordinal="Primary"/><Related_Weakness Nature="ChildOf" CWE_ID="200" View_ID="1003" Ordinal="Primary"/><Related_Weakness Nature="ChildOf" CWE_ID="755" View_ID="1000"/></Related_Weaknesses><Applicable_Platforms>[应用平台]<Language Name="PHP" Prevalence="Often"/><Language Class="Language-Independent" Prevalence="Undetermined"/></Applicable_Platforms> <Modes_Of_Introduction><Introduction><Phase>Architecture and Design</Phase></Introduction><Introduction><Phase>Implementation</Phase><Note>REALIZATION: This weakness is caused during implementation of an architectural security tactic.</Note></Introduction><Introduction><Phase>System Configuration</Phase></Introduction><Introduction><Phase>Operation</Phase></Introduction></Modes_Of_Introduction><Likelihood_Of_Exploit>High</Likelihood_Of_Exploit><Common_Consequences>[常见后果]<Consequence><Scope>Confidentiality</Scope> [范围：保密性]<Impact>Read Application Data</Impact> [影响：读取应用数据]<Note>Often this will either reveal sensitive information which may be used for a later attack or private information stored in the server.</Note></Consequence></Common_Consequences><Detection_Methods>[检测方法]<Detection_Method><Method>Manual Analysis</Method>[手动分析]<Description>This weakness generally requires domain-specific interpretation using manual analysis. However, the number of potential error conditions may be too large to cover completely within limited time constraints.</Description><Effectiveness>High</Effectiveness></Detection_Method><Detection_Method><Method>Automated Analysis</Method><Description>Automated methods may be able to detect certain idioms automatically, such as exposed stack traces or pathnames, but violation of business rules or privacy requirements is not typically feasible.</Description><Effectiveness>Moderate</Effectiveness>[中等]</Detection_Method><Detection_Method Detection_Method_ID="DM-2"><Method>Automated Dynamic Analysis</Method><Description><xhtml:p>This weakness can be detected using dynamic tools and techniques that interact with the software using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The software's operation may slow down, but it should not become unstable, crash, or generate incorrect results.</xhtml:p><xhtml:p>Error conditions may be triggered with a stress-test by calling the software simultaneously from a large number of threads or processes, and look for evidence of any unexpected behavior.</xhtml:p></Description><Effectiveness>Moderate</Effectiveness></Detection_Method><Detection_Method Detection_Method_ID="DM-12"><Method>Manual Dynamic Analysis</Method><Description>Identify error conditions that are not likely to occur during normal usage and trigger them. For example, run the program under low memory conditions, run with insufficient privileges or permissions, interrupt a transaction before it is completed, or disable connectivity to basic network services such as DNS. Monitor the software for any unexpected behavior. If you trigger an unhandled exception or similar error that was discovered and handled by the application's environment, it may still indicate unexpected conditions that were not handled by the application itself.</Description></Detection_Method></Detection_Methods><Potential_Mitigations>】[缓解措施]<Mitigation Mitigation_ID="MIT-39"><Phase>Implementation</Phase><Description>[具体方法]<xhtml:p>Ensure that error messages only contain minimal details that are useful to the intended audience, and nobody else. The messages need to strike the balance between being too cryptic and not being cryptic enough. They should not necessarily reveal the methods that were used to determine the error. Such detailed information can be used to refine the original attack to increase the chances of success.</xhtml:p><xhtml:p>If errors must be tracked in some detail, capture them in log messages - but consider what could occur if the log messages can be viewed by attackers. Avoid recording highly sensitive information such as passwords in any form. Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a username is valid or not.</xhtml:p></Description></Mitigation><Mitigation><Phase>Implementation</Phase><Description>Handle exceptions internally and do not display errors containing potentially sensitive information to a user.</Description></Mitigation><Mitigation Mitigation_ID="MIT-33"><Phase>Implementation</Phase><Strategy>Attack Surface Reduction</Strategy><Description>Use naming conventions and strong types to make it easier to spot when sensitive data is being used. When creating structures, objects, or other complex entities, separate the sensitive and non-sensitive data as much as possible.</Description><Effectiveness>Defense in Depth</Effectiveness><Effectiveness_Notes>This makes it easier to spot places in the code where data is being used that is unencrypted.</Effectiveness_Notes></Mitigation><Mitigation Mitigation_ID="MIT-40"><Phase>Implementation</Phase><Phase>Build and Compilation</Phase><Strategy>Compilation or Build Hardening</Strategy><Description>Debugging information should not make its way into a production release.</Description></Mitigation><Mitigation Mitigation_ID="MIT-40"><Phase>Implementation</Phase><Phase>Build and Compilation</Phase><Strategy>Environment Hardening</Strategy><Description>Debugging information should not make its way into a production release.</Description></Mitigation><Mitigation><Phase>System Configuration</Phase><Description>Where available, configure the environment to use less verbose error messages. For example, in PHP, disable the display_errors setting during configuration, or at runtime using the error_reporting() function.</Description></Mitigation><Mitigation><Phase>System Configuration</Phase><Description>Create default error pages or messages that do not leak any information.</Description></Mitigation></Potential_Mitigations><Demonstrative_Examples>[示范性例子]<Demonstrative_Example><Intro_Text>In the following example, sensitive information might be printed depending on the exception that occurs.</Intro_Text><Example_Code Nature="bad" Language="Java"><xhtml:div>try {<xhtml:div style="margin-left:10px;">/.../</xhtml:div>}<xhtml:br/>catch (Exception e) {<xhtml:div style="margin-left:10px;">System.out.println(e);</xhtml:div>}</xhtml:div></Example_Code><Body_Text>If an exception related to SQL is handled by the catch, then the output might contain sensitive information such as SQL query structure or private information. If this output is redirected to a web user, this may represent a security problem.</Body_Text></Demonstrative_Example><Demonstrative_Example><Intro_Text>This code tries to open a database connection, and prints any exceptions that occur.</Intro_Text><Example_Code Nature="bad" Language="PHP"><xhtml:div>try {<xhtml:div style="margin-left:10px;">openDbConnection();</xhtml:div>}<xhtml:br/><xhtml:i>//print exception message that includes exception message and configuration file location</xhtml:i><xhtml:br/>catch (Exception $e) {<xhtml:div style="margin-left:10px;">echo 'Caught exception: ', $e->getMessage(), '\n';<xhtml:br/>echo 'Check credentials in config file at: ', $Mysql_config_location, '\n';</xhtml:div>}</xhtml:div></Example_Code><Body_Text>If an exception occurs, the printed message exposes the location of the configuration file the script is using. An attacker can use this information to target the configuration file (perhaps exploiting a Path Traversal weakness). If the file can be read, the attacker could gain credentials for accessing the database. The attacker may also be able to replace the file with a malicious one, causing the application to use an arbitrary database.</Body_Text></Demonstrative_Example><Demonstrative_Example><Intro_Text>The following code generates an error message that leaks the full pathname of the configuration file.</Intro_Text><Example_Code Nature="bad" Language="Perl"><xhtml:div>$ConfigDir = "/home/myprog/config";<xhtml:br/>$uname = GetUserInput("username");<xhtml:br/><xhtml:br/><xhtml:i># avoid CWE-22, CWE-78, others.</xhtml:i><xhtml:br/>ExitError("Bad hacker!") if ($uname !~ /^\w+$/);<xhtml:br/>$file = "$ConfigDir/$uname.txt";<xhtml:br/>if (! (-e $file)) {<xhtml:div style="margin-left:10px;">ExitError("Error: $file does not exist");</xhtml:div>}<xhtml:br/>...</xhtml:div></Example_Code><Body_Text>If this code is running on a server, such as a web application, then the person making the request should not know what the full pathname of the configuration directory is. By submitting a username that does not produce a $file that exists, an attacker could get this pathname. It could then be used to exploit path traversal or symbolic link following problems that may exist elsewhere in the application.</Body_Text></Demonstrative_Example><Demonstrative_Example><Intro_Text>In the example below, the method getUserBankAccount retrieves a bank account object from a database using the supplied username and account number to query the database. If an SQLException is raised when querying the database, an error message is created and output to a log file.</Intro_Text><Example_Code Nature="bad" Language="Java"><xhtml:div>public BankAccount getUserBankAccount(String username, String accountNumber) {<xhtml:div style="margin-left:10px;"><xhtml:div>BankAccount userAccount = null;<xhtml:br/>String query = null;<xhtml:br/>try {<xhtml:div style="margin-left:10px;">if (isAuthorizedUser(username)) {<xhtml:div style="margin-left:10px;">query = "SELECT * FROM accounts WHERE owner = "<xhtml:br/>+ username + " AND accountID = " + accountNumber;<xhtml:br/>DatabaseManager dbManager = new DatabaseManager();<xhtml:br/>Connection conn = dbManager.getConnection();<xhtml:br/>Statement stmt = conn.createStatement();<xhtml:br/>ResultSet queryResult = stmt.executeQuery(query);<xhtml:br/>userAccount = (BankAccount)queryResult.getObject(accountNumber);</xhtml:div>}</xhtml:div>} catch (SQLException ex) {<xhtml:div style="margin-left:10px;">String logMessage = "Unable to retrieve account information from database,\nquery: " + query;<xhtml:br/>Logger.getLogger(BankManager.class.getName()).log(Level.SEVERE, logMessage, ex);</xhtml:div>}<xhtml:br/>return userAccount;</xhtml:div></xhtml:div>}</xhtml:div></Example_Code><Body_Text>The error message that is created includes information about the database query that may contain sensitive information about the database or query logic. In this case, the error message will expose the table name and column names used in the database. This data could be used to simplify other attacks, such as SQL injection (CWE-89) to directly access the database.</Body_Text></Demonstrative_Example></Demonstrative_Examples><Observed_Examples>[观察到的例子]<Observed_Example><Reference>CVE--2049</Reference><Description>POP3 server reveals a password in an error message after multiple APOP commands are sent. Might be resultant from another weakness.</Description><Link>/cgi-bin/cvename.cgi?name=CVE--2049</Link></Observed_Example><Observed_Example><Reference>CVE--5172</Reference><Description>Program reveals password in error message if attacker can trigger certain database errors.</Description><Link>/cgi-bin/cvename.cgi?name=CVE--5172</Link></Observed_Example><Observed_Example><Reference>CVE--4638</Reference><Description>Composite: application running with high privileges allows user to specify a restricted file to process, which generates a parsing error that leaks the contents of the file.</Description><Link>/cgi-bin/cvename.cgi?name=CVE--4638</Link></Observed_Example><Observed_Example><Reference>CVE--1579</Reference><Description>Existence of user names can be determined by requesting a nonexistent blog and reading the error message.</Description><Link>/cgi-bin/cvename.cgi?name=CVE--1579</Link></Observed_Example><Observed_Example><Reference>CVE--1409</Reference><Description>Direct request to library file in web application triggers pathname leak in error message.</Description><Link>/cgi-bin/cvename.cgi?name=CVE--1409</Link></Observed_Example><Observed_Example><Reference>CVE--3060</Reference><Description>Malformed input to login page causes leak of full path when IMAP call fails.</Description><Link>/cgi-bin/cvename.cgi?name=CVE--3060</Link></Observed_Example><Observed_Example><Reference>CVE--0603</Reference><Description>Malformed regexp syntax leads to information exposure in error message.</Description><Link>/cgi-bin/cvename.cgi?name=CVE--0603</Link></Observed_Example></Observed_Examples><Taxonomy_Mappings><Taxonomy_Mapping Taxonomy_Name="CLASP"><Entry_Name>Accidental leaking of sensitive information through error messages</Entry_Name></Taxonomy_Mapping><Taxonomy_Mapping Taxonomy_Name="OWASP Top Ten "><Entry_ID>A6</Entry_ID><Entry_Name>Information Leakage and Improper Error Handling</Entry_Name><Mapping_Fit>CWE More Specific</Mapping_Fit></Taxonomy_Mapping><Taxonomy_Mapping Taxonomy_Name="OWASP Top Ten "><Entry_ID>A7</Entry_ID><Entry_Name>Improper Error Handling</Entry_Name><Mapping_Fit>CWE More Specific</Mapping_Fit></Taxonomy_Mapping><Taxonomy_Mapping Taxonomy_Name="OWASP Top Ten "><Entry_ID>A10</Entry_ID><Entry_Name>Insecure Configuration Management</Entry_Name><Mapping_Fit>CWE More Specific</Mapping_Fit></Taxonomy_Mapping><Taxonomy_Mapping Taxonomy_Name="The CERT Oracle Secure Coding Standard for Java ()"><Entry_ID>ERR01-J</Entry_ID><Entry_Name>Do not allow exceptions to expose sensitive information</Entry_Name></Taxonomy_Mapping><Taxonomy_Mapping Taxonomy_Name="Software Fault Patterns"><Entry_ID>SFP23</Entry_ID><Entry_Name>Exposed Data</Entry_Name></Taxonomy_Mapping></Taxonomy_Mappings><Related_Attack_Patterns>[相关攻击模式]<Related_Attack_Pattern CAPEC_ID="214"/><Related_Attack_Pattern CAPEC_ID="215"/><Related_Attack_Pattern CAPEC_ID="463"/><Related_Attack_Pattern CAPEC_ID="54"/><Related_Attack_Pattern CAPEC_ID="7"/></Related_Attack_Patterns><References><Reference External_Reference_ID="REF-174"/><Reference External_Reference_ID="REF-175" Section="Section 9.2, Page 326"/><Reference External_Reference_ID="REF-176" Section="Chapter 16, "General Good Practices." Page 415"/><Reference External_Reference_ID="REF-44" Section=""Sin 11: Failure to Handle Errors Correctly." Page 183"/><Reference External_Reference_ID="REF-44" Section=""Sin 12: Information Leakage." Page 191"/><Reference External_Reference_ID="REF-179"/><Reference External_Reference_ID="REF-62" Section="Chapter 3, "Overly Verbose Error Messages", Page 75"/></References><Content_History>[更改的历史信息]<Submission><Submission_Name>CLASP</Submission_Name></Submission><Modification><Modification_Name>Eric Dalci</Modification_Name><Modification_Organization>Cigital</Modification_Organization><Modification_Date>-07-01</Modification_Date><Modification_Comment>updated Time_of_Introduction</Modification_Comment></Modification><Modification><Modification_Organization>Veracode</Modification_Organization><Modification_Date>-08-15</Modification_Date><Modification_Comment>Suggested OWASP Top Ten mapping</Modification_Comment></Modification><Modification><Modification_Name>CWE Content Team</Modification_Name><Modification_Organization>MITRE</Modification_Organization><Modification_Date>-09-08</Modification_Date><Modification_Comment>updated Applicable_Platforms, Common_Consequences, Relationships, Other_Notes, Taxonomy_Mappings</Modification_Comment></Modification><Modification><Modification_Name>CWE Content Team</Modification_Name><Modification_Organization>MITRE</Modification_Organization><Modification_Date>-10-14</Modification_Date><Modification_Comment>updated Relationships</Modification_Comment></Modification><Modification><Modification_Name>CWE Content Team</Modification_Name><Modification_Organization>MITRE</Modification_Organization><Modification_Date>-01-12</Modification_Date><Modification_Comment>updated Demonstrative_Examples, Description, Name, Observed_Examples, Other_Notes, Potential_Mitigations, Relationships, Time_of_Introduction</Modification_Comment></Modification><Modification><Modification_Name>CWE Content Team</Modification_Name><Modification_Organization>MITRE</Modification_Organization><Modification_Date>-03-10</Modification_Date><Modification_Comment>updated Demonstrative_Examples, Potential_Mitigations, Relationships</Modification_Comment></Modification><Modification><Modification_Name>CWE Content Team</Modification_Name><Modification_Organization>MITRE</Modification_Organization><Modification_Date>-12-28</Modification_Date><Modification_Comment>updated Demonstrative_Examples, Name, Potential_Mitigations, References, Time_of_Introduction</Modification_Comment></Modification><Modification><Modification_Name>CWE Content Team</Modification_Name><Modification_Organization>MITRE</Modification_Organization><Modification_Date>-02-16</Modification_Date><Modification_Comment>updated Detection_Factors, References, Relationships</Modification_Comment></Modification><Modification><Modification_Name>CWE Content Team</Modification_Name><Modification_Organization>MITRE</Modification_Organization><Modification_Date>-04-05</Modification_Date><Modification_Comment>updated Related_Attack_Patterns</Modification_Comment></Modification><Modification><Modification_Name>CWE Content Team</Modification_Name><Modification_Organization>MITRE</Modification_Organization><Modification_Date>-06-21</Modification_Date><Modification_Comment>updated Common_Consequences, Detection_Factors, Potential_Mitigations, References</Modification_Comment></Modification><Modification><Modification_Organization>Veracode</Modification_Organization><Modification_Date>-09-09</Modification_Date><Modification_Comment>Suggested OWASP Top Ten mapping</Modification_Comment></Modification><Modification><Modification_Name>CWE Content Team</Modification_Name><Modification_Organization>MITRE</Modification_Organization><Modification_Date>-09-27</Modification_Date><Modification_Comment>updated Potential_Mitigations, Relationships</Modification_Comment></Modification><Modification><Modification_Name>CWE Content Team</Modification_Name><Modification_Organization>MITRE</Modification_Organization><Modification_Date>-03-29</Modification_Date><Modification_Comment>updated Demonstrative_Examples, Observed_Examples, Relationships</Modification_Comment></Modification><Modification><Modification_Name>CWE Content Team</Modification_Name><Modification_Organization>MITRE</Modification_Organization><Modification_Date>-06-01</Modification_Date><Modification_Comment>updated Relationships, Taxonomy_Mappings</Modification_Comment></Modification><Modification><Modification_Name>CWE Content Team</Modification_Name><Modification_Organization>MITRE</Modification_Organization><Modification_Date>-06-27</Modification_Date><Modification_Comment>updated Relationships</Modification_Comment></Modification><Modification><Modification_Name>CWE Content Team</Modification_Name><Modification_Organization>MITRE</Modification_Organization><Modification_Date>-09-13</Modification_Date><Modification_Comment>updated Relationships, Taxonomy_Mappings</Modification_Comment></Modification><Modification><Modification_Name>CWE Content Team</Modification_Name><Modification_Organization>MITRE</Modification_Organization><Modification_Date>-05-11</Modification_Date><Modification_Comment>updated References, Related_Attack_Patterns, Relationships</Modification_Comment></Modification><Modification><Modification_Name>CWE Content Team</Modification_Name><Modification_Organization>MITRE</Modification_Organization><Modification_Date>-07-17</Modification_Date><Modification_Comment>updated References</Modification_Comment></Modification><Modification><Modification_Name>CWE Content Team</Modification_Name><Modification_Organization>MITRE</Modification_Organization><Modification_Date>-06-23</Modification_Date><Modification_Comment>updated Relationships</Modification_Comment></Modification><Modification><Modification_Name>CWE Content Team</Modification_Name><Modification_Organization>MITRE</Modification_Organization><Modification_Date>-07-30</Modification_Date><Modification_Comment>updated Relationships, Taxonomy_Mappings</Modification_Comment></Modification><Modification><Modification_Name>CWE Content Team</Modification_Name><Modification_Organization>MITRE</Modification_Organization><Modification_Date>-11-08</Modification_Date><Modification_Comment>updated Applicable_Platforms, Modes_of_Introduction, References, Relationships, Taxonomy_Mappings</Modification_Comment></Modification><Modification><Modification_Name>CWE Content Team</Modification_Name><Modification_Organization>MITRE</Modification_Organization><Modification_Date>-03-27</Modification_Date><Modification_Comment>updated References, Relationships</Modification_Comment></Modification><Modification><Modification_Name>CWE Content Team</Modification_Name><Modification_Organization>MITRE</Modification_Organization><Modification_Date>-01-03</Modification_Date><Modification_Comment>updated Taxonomy_Mappings</Modification_Comment></Modification><Modification><Modification_Name>CWE Content Team</Modification_Name><Modification_Organization>MITRE</Modification_Organization><Modification_Date>-06-20</Modification_Date><Modification_Comment>updated Relationships</Modification_Comment></Modification><Previous_Entry_Name Date="-01-12">Error Message Information Leaks</Previous_Entry_Name><Previous_Entry_Name Date="-12-28">Error Message Information Leak</Previous_Entry_Name></Content_History></Weakness>
2.CPE解析https://nvd.nist.gov/products/cpe
CPE是（Common Platform Enumeration的缩写）以标准化方式为软件应用程序、操作系统及硬件命名的方法。
CPE是用于信息技术系统，软件和程序包的结构化命名方案。基于统一资源标识符（URI）的通用语法，CPE包括形式名称格式，用于根据系统检查名称的方法以及用于将文本和测试绑定到名称的描述格式。
内容格式：cpe:/<part>:<vendor>:<product>:<version>:<update>:<edition>:<language>
cpe:2.3:part:vendor:product:version:update:edition:language:sw_edition:target_sw:target_hw:other
其中，part表示目标类型，允许的值有a（应用程序）、h（硬件平台）、o（操作系统）；vendor表示向量类型；product表示产品名称；version表示版本号；update表示更新包；edition表示版本；language表示语言项。
<cpe-item name="cpe:/a:dracut_project:dracut:031"><title xml:lang="en-US">Dracut Project Dracut 031</title><references><reference href="/dracutdevs/dracut/releases?after=002">Version</reference></references><cpe-23:cpe23-item name="cpe:2.3:a:dracut_project:dracut:031:*:*:*:*:*:*:*"/></cpe-item>
参考:/weixin_33913332/article/details/92917172
