This slide discuss about security issues when exception handling is not correct.

1. Exception Handling
Security Practices

2. Error Handling Mistakes
• Information leakage: Leaking sensitive information in error
messages can unintentionally help attackers. For example, an error
that returns a stack trace or other internal error details can provide
an attacker with information about your environment. Even small
differences in handling different error conditions (e.g., returning
“invalid user” or “invalid password” on authentication errors) can
provide valuable clues to attackers. As described above, be sure to log
error details for forensics and debugging purposes, but don’t expose
this information, especially to an external client.

3. Error Handling Mistakes
• DOS: A lack of basic error handling can lead to system shutdown. This is
usually a fairly easy vulnerability for attackers to exploit. Other error
handling problems could lead to increased usage of CPU or disk in ways that
could degrade the system.

4. Error Mistake Example

10. Rules
• Ensure that error messages displayed to users do not leak critical data,
but are still verbose enough to enable the proper user response.
• Ensure that exceptions are logged in a way that gives enough
information for support, QA, forensics or incident response teams to
understand the problem.

14. Http Status Codes
• Return corresponding HTTP Status Codes
• Do not wrap errors and return 200 Code for all requests
• Security Monitoring Systems may not work, for example auth failure result
must be 401 code

15. References
• CWE-209: Generation of Error Message Containing Sensitive Information
(https://cwe.mitre.org/data/definitions/209.html)
• OWASP Cheet sheet
(https://cheatsheetseries.owasp.org/cheatsheets/Error_Handling_Cheat_Shee
t.html)
• OWASP Top Ten Proactive Controls 2018 - C10: Handle all Errors and
Exceptions (https://owasp.org/www-project-proactive-controls/v3/en/c10-
errors-exceptions)