CWE-1295: Debug Messages Revealing Unnecessary Information

How it's found

Debug Messages Revealing Unnecessary Information is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.

Debug messages are messages that help troubleshoot an issue by revealing the internal state of the system. For example, debug data in design can be exposed through internal memory array dumps or boot logs through interfaces like UART via TAP commands, scan chain, etc. Thus, the more information contained in a debug message, the easier it is to debug. However, there is also the risk of revealing information that could help an attacker either decipher a vulnerability, and/or gain a better understanding of the system. Thus, this extra information could lower the "security by obscurity" factor. While "security by obscurity" alone is insufficient, it can help as a part of "Defense-in-depth".

Consequences

• Read Memory, Bypass Protection Mechanism, Gain Privileges or Assume Identity, Varies by Context

Mitigations

• Implementation: Ensure that a debug message does not reveal any unnecessary information during the debug process for the intended response.

Where this fits in a TurboPentest engagement

This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.

Frequently asked questions

Related CWEs

• Class weakness
  CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
• Base weakness
  CWE-209: Generation of Error Message Containing Sensitive Information