CWE-7 J2EE Misconfiguration: Missing Custom Error Page

The product has a J2EE component that does not have a custom error page.

• Confidentiality: Read Application Data — When an attacker explores a web site looking for vulnerabilities, the amount of information that the site provides is crucial to the eventual success or failure of any attempted attacks. A stack trace might show the attacker a malformed SQL query string, the type of database being used, and the version of the application container. This information enables the attacker to target known vulnerabilities in these components.

• [Implementation] Handle exceptions appropriately in source code. Catch java.lang.Throwable exceptions to prevent attackers from mining information from the application container's built-in error response. • [Implementation, System Configuration] Always define appropriate error pages, including for 4xx errors (e.g. 404) and 5xx (e.g. 500) errors. The application configuration should specify a default error page in order to guarantee that the application will never leak error messages to an attacker. Handling standard HTTP error codes is useful and user-friendly in addition to being a good security practice, and a good configuration will also define a last-chance error handler that catches any exception that could possibly be thrown by the application. • [Implementation] Do not attempt to process an error or attempt to mask it. • [Implementation] Verify return values are correct and do not supply sensitive information about the system.

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)