Exception Handling Vulnerabilities

Exception Handling Vulnerabilities

Purpose

Provide detection patterns for vulnerabilities related to improper exception and error handling, including XXE (XML External Entity) injection, stack trace disclosure, and authentication bypass via exceptions.

OWASP Top 10 Mapping

Category: Context-dependent

Improper exception handling is not a standalone official OWASP Top 10 bucket. In practice, findings from this skill often map to:

• A05 - Security Misconfiguration
• A08 - Software and Data Integrity Failures
• A03 - Injection, when XXE or parser misuse is the concrete issue

CWEs:

• CWE-390: Detection of Error Condition Without Action
• CWE-392: Missing Report of Error Condition
• CWE-460: Improper Cleanup on Thrown Exception
• CWE-611: Improper Restriction of XML External Entity Reference (XXE)
• CWE-755: Improper Handling of Exceptional Conditions

When to Use

Activate this skill when:

• Searching for XML parsing vulnerabilities
• Reviewing error handling code
• Looking for information disclosure via exceptions
• Finding authentication/authorization bypass via exception paths

---

XXE (XML External Entity) Injection

Overview

XXE occurs when XML parsers process external entity references in untrusted XML input, allowing attackers to read files, perform SSRF, or cause DoS.

Detection Patterns

Java

# Vulnerable XML parsers
grep -rniE "DocumentBuilderFactory|SAXParserFactory|XMLInputFactory|TransformerFactory|SchemaFactory|XMLReader" --include="*.java"

# Check for disabled external entities (SAFE patterns)
grep -rniE "setFeature.*FEATURE_SECURE_PROCESSING|setFeature.*disallow-doctype-decl|setExpandEntityReferences.*false" --include="*.java"

Vulnerable Pattern:

// VULNERABLE: Default parser allows XXE
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
DocumentBuilder db = dbf.newDocumentBuilder();
Document doc = db.parse(userInputStream);  // XXE possible

Secure Pattern:

// SAFE: External entities disabled
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);