This weakness occurs when an application unintentionally includes sensitive information—such as internal IDs, file paths, API keys, or database details—in data…
This weakness occurs when an application unintentionally includes sensitive information—such as internal IDs, file paths, API keys, or database details—in data sent to users or external systems. Unlike access control failures, the information isn't stolen; the application itself leaks it. This can expose architectural details, enable account enumeration, or reveal credentials that attackers can use for further compromise.
Developers often include internal identifiers, debug information, or system details in responses without realizing they're visible to end users. This happens most commonly in error messages, API responses, HTML comments, or log files that are accidentally exposed. The root cause is usually a lack of awareness about what data is sensitive in context, combined with insufficient review of what gets sent to clients. Even "harmless" details like sequential user IDs, database table names, or server software versions can be pieced together by attackers to build a map of the system.
Leaked information can enable account enumeration (testing which usernames exist), facilitate targeted attacks (knowing the exact software version helps attackers find known exploits), or expose credentials embedded in responses. In some cases, internal file paths or API endpoints revealed in error messages allow attackers to bypass security controls or discover hidden functionality. The impact ranges from minor information disclosure to complete system compromise, depending on what is leaked and how an attacker uses it.
import json
from flask import Flask, request, jsonify
app = Flask(__name__)
@app.route('/api/user/<user_id>')
def get_user(user_id):
try:
user = database.query(f"SELECT * FROM users WHERE id = {user_id}")
return jsonify({
'user_id': user['id'],
'username': user['username'],
'internal_account_number': user['account_number'],
'database_path': '/var/db/app/users.sqlite',
'api_key': user['api_key']
})
except Exception as e:
return jsonify({'error': str(e), 'query': f"SELECT * FROM users WHERE id = {user_id}"})Why it's vulnerable:
The response includes internal account numbers, database paths, and API keys that should never be sent to a client. The error handler also echoes the SQL query, revealing database structure.
import json
from flask import Flask, request, jsonify
app = Flask(__name__)
@app.route('/api/user/<user_id>')
def get_user(user_id):
try:
user = database.query("SELECT id, username FROM users WHERE id = ?", (user_id,))
return jsonify({
'user_id': user['id'],
'username': user['username']
})
except Exception as e:
app.logger.error(f"Database error: {e}")
return jsonify({'error': 'Unable to retrieve user'}), 500<?php
$user_id = $_GET['id'];
$result = mysqli_query($conn, "SELECT * FROM users WHERE id = $user_id");
$user = mysqli_fetch_assoc($result);
echo json_encode([
'user_id' => $user['id'],
'username' => $user['username'],
'internal_notes' => $user['admin_notes'],
'db_server' => 'db-prod-01.internal.local',
'api_secret' => $user['secret_key']
]);
?>Why it's vulnerable:
The response exposes internal notes, database server hostname, and API secrets. These details should never be sent to the client.
<?php
$user_id = intval($_GET['id']);
$stmt = $conn->prepare("SELECT id, username FROM users WHERE id = ?");
$stmt->bind_param("i", $user_id);
$stmt->execute();
$result = $stmt->get_result();
$user = $result->fetch_assoc();
echo json_encode([
'user_id' => $user['id'],
'username' => $user['username']
]);
?>SELECT * or serialize entire objects.
Check your application's network responses (using browser developer tools or proxy logs) for unexpected fields like internal IDs, file paths, database names, or server hostnames. Review error pages and API responses for stack traces, SQL queries, or configuration details. Search your codebase for places where entire database records or user objects are serialized and returned without filtering.
