Server Error Messages

Message examples may be PHP error codes which return SQL, in some cases they will even show data results. For instance, if an attacker is probing a website, and putting in invalid data to a form, the web script may not handle all cases well. If the attacker triggers an application error, and the code is configured to return this error, the attacker may expose some data about either other users, or the application design, or the server configuration.

For instance, an error might reveal something like this to an attacker:

Table 'mydb.table' doesn't exist query: SELECT col FROM ctable WHERE id=3 in /home/auser/public_html/extra.inc(1699) : eval()'d code on line 2.

which shows the attacker how data is being queried, and shows some of the database structure information.

In extreme cases, these error messages may be extremely detailed, and even include information which could compromise the entire system. Take the following (real, but modified) error message:

Warning: mysql_query() [function.mysql-query]: Unable to save result set in filename.php
execute command denied to user 'username'@'%' for routine 'database_name.MyUDF'
Connection information used:
Username: username
Password: password
Port: 123456
Server: localhost

In this case, the entire database connection information was compromised. Developers often write in these kinds of outputs while developing, to make debugging easier. However, left on in a production environment, the results can be deadly.

Server messages not meant to be seen generally result in some sort of data loss, whether it is data about your site configuration, server configuration, or even other users in rare cases.

The best way to avoid all possible error messages is to define a friendly error message. This takes some extra work, but can be used to prevent any errors from being displayed. Each scripting language will have its own unique ways of disabling error handling. It is recommended to divert errors from being displayed to a user, and placing them in a secure log instead.

Some steps you can take for PHP include:

• Search web directories for files which run php_info(). Remove these so they cannot get run (this PHP function returns a plethora of PHP information.)
• In php.ini, set display_errors to disabled
• Create a custom error handler to log scripts and display a friendly message to the user:

  <?php
  function error_handler($errno, $errstr, $errfile, $errline)
  {
      write_to_logs($errno, $errstr, $errfile, $errline);
      echo "Hi user, this is a friendly error message";
  }
  set_error_handler("error_handler");
  ?>
  

PHP Error Handler

Golem Technologies includes numerous different server setting scans to help you reduce your exposure to attack with thorough security scanning, including application server setup. See how the Golem Scan can help your business today.