VNX-536: Servlet Runtime Error Message Containing Sensitive Information

Detects Java servlets and JSPs that catch an exception and write its message or stack trace to the HTTP response: printStackTrace into the response writer, print/write of the exception or its getMessage()/toString() on response.getWriter() or a writer taken from it, response.sendError(code, e.getMessage()), and <%= exception.getMessage() %> in JSP.

Field	Value
Rule ID	`VNX-536`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	Java
CWE	CWE-536
CAPEC	CAPEC-97
ATT&CK	T1557
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`servlet` `error-handling` `information-exposure` `cwe-536`
Source	`internal/sast/rules/vnx-536.rego`

Overview

Java Servlets that catch exceptions and write stack traces or raw exception messages to the HTTP response expose internal implementation details, class names, method signatures, file paths, and line numbers, that attackers use to target follow-on exploits.

Why This Matters

A stack trace tells an attacker exactly what framework versions, libraries, and code paths exist. It reveals SQL queries, file paths, and configuration details. Error details are routinely exploited in reconnaissance phases of targeted attacks.

What Gets Flagged

try {
    process(request);
} catch (Exception e) {
    response.getWriter().println("Error: " + e.getMessage());   // FLAGGED
}

catch (Exception e) {
    response.sendError(500, e.getLocalizedMessage());           // FLAGGED
}

catch (IOException ex) {
    ex.printStackTrace(resp.getWriter());                       // FLAGGED
}

catch (NoSuchAlgorithmException
        | InvalidKeyException problem) {                          // a wrapped multi-catch header
    problem.printStackTrace(response.getWriter());               // FLAGGED
}

<p><%= exception.getMessage() %></p>                            <%-- FLAGGED --%>

Not flagged: exceptions that are logged (log.error(..., e), e.printStackTrace() to stderr), generic messages written to the response, values written outside a catch block, comments and test code. Stack traces returned by other frameworks, and database error messages in general, are VNX-209; a servlet line reported here is not also reported by VNX-209.

Remediation

Log exceptions server-side and return a generic error to the client:

// SAFE: Log internally, return generic message
try {
    doSomething();
} catch (Exception e) {
    logger.error("Operation failed", e);  // Log with full details
    response.setStatus(500);
    response.getWriter().println("{\"error\": \"An internal error occurred\"}");
}

Configure a custom error page in web.xml to catch unhandled exceptions.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-536
// nosec vnx-536

Or record an ignore rule: vulnetix ignore add --rule vnx-536 --reason "...". See Suppressing findings.