Insurance Site Leak: Java StackTrace Exposure

G5 Cyber Security

2 months ago

TL;DR

An insurance website is publicly exposing detailed stack traces from its Java-based JSON parser when errors occur. This reveals internal code structure and potentially vulnerabilities. We’ll cover how to identify the issue, why it’s bad, and steps to fix it by disabling detailed error reporting in production.

Understanding the Problem

When a web application encounters an error while processing data (like parsing JSON), it often generates an error message. A stack trace is a report showing exactly where in the code the error happened, including all the functions that were called leading up to the problem. While incredibly useful for developers during testing and debugging, exposing stack traces to the public on a live website is a serious security risk.

Here’s why it’s dangerous:

Reveals Internal Structure: Attackers can learn about your application’s architecture, frameworks used, and potentially sensitive file paths.
Aids Exploitation: Stack traces might reveal the exact lines of code vulnerable to attacks, making it easier for attackers to craft exploits.
Information Disclosure: Sometimes stack traces contain internal variable names or configuration details that shouldn’t be public.

Step-by-Step Fix

Confirm the Leak (if you haven’t already):
- Try sending invalid JSON data to the website’s API endpoints. For example, a missing closing bracket or an unexpected character.
- Examine the response carefully. Look for error messages that include long blocks of text with lines starting with “at…” – these are stack traces.
Identify the Logging Framework:
Most Java applications use a logging framework like Log4j, SLF4J (with a backend like Logback or java.util.logging), or similar. You need to find out which one your application uses.
- Check Application Configuration: Look for configuration files named log4j.properties, logback.xml, or similar in the application’s deployment directory.
- Examine Code: Search the codebase for imports like org.apache.log4j.*, org.slf4j.*, or java.util.logging.*.
Disable Detailed Error Reporting in Production:
The goal is to configure the logging framework to log errors without including full stack traces in production environments.
- Log4j (Example): In log4j.properties, adjust the appender configuration for your error logger. Change a line like this:
```
log4j.appender.errorAppender = org.apache.log4j.FileAppender
log4j.appender.errorAppender.layout = org.apache.log4j.PatternLayout
log4j.appender.errorAppender.layout.ConverterMap={org.apache.log4j.spi.ThrowableInformationAppender=false}
```
  to:
```
log4j.appender.errorAppender = org.apache.log4j.FileAppender
log4j.appender.errorAppender.layout = org.apache.log4j.PatternLayout
log4j.appender.errorAppender.layout.ConverterMap={org.apache.log4j.spi.ThrowableInformationAppender=false}
```
- SLF4J/Logback (Example): In logback.xml, modify the logger configuration for your application:
```
<logger name="your.application.package" level="ERROR" additivity="false">
  <appender-ref ref="errorAppender"/>
</logger>
```
  Ensure that the appender configuration (e.g., errorAppender) does not include a ThrowableInformationAppender or similar component.
- java.util.logging (Example): Configure the logging level to avoid printing stack traces. This is often done through system properties or a configuration file.
```
java.util.logging.level = ERROR
```
Restart the Application:
After making changes to the logging configuration, you must restart your application for the new settings to take effect.
Verify the Fix:
- Repeat the test from Step 1 (sending invalid JSON).
- Confirm that the error response no longer includes detailed stack traces. You should see a more generic error message instead.

Additional Considerations

Error Handling: Implement robust error handling in your code to catch exceptions gracefully and return user-friendly error messages.
Security Audits: Regularly conduct security audits of your application to identify and address potential vulnerabilities, including information leaks.
Web Application Firewall (WAF): Consider using a WAF to filter out malicious requests and protect against attacks that might exploit exposed stack traces.