Fuzzing for garnering J2EE/.NET-based stack traces, for application mapping
Attack Pattern ID: 214 (Detailed Attack Pattern Completeness: Stub)Typical Severity: LowStatus: Draft
+ Description


An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes any stack traces produced by error messages. Fuzzing techniques involve sending random or malformed messages to a target and monitoring the target's response. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to cause the targeted application to return an error including a stack trace, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash. The strack trace enumerates the chain of methods that led up to the point where the error was encountered. This can not only reveal the names of the methods (some of which may have known weaknesses) but possibly also the location of class files and libraries as well as parameter values. In some cases, the stack trace might even disclose sensitive configuration or user information.

+ Attack Prerequisites

The target application must fail to sanitize incoming messages adequately before processing and must generate a stack trace in at least some error situations.

+ Resources Required

The attacker must have sufficient access to send messages to the target. The attacker must also have the ability to observe the stack trace produced by the target application. Fuzzing tools, which automatically generate and send message variants, are necessary for this attack.

+ Related Weaknesses
CWE-IDWeakness NameWeakness Relationship Type
209Information Exposure Through an Error MessageTargeted
388Error HandlingTargeted
+ Related Vulnerabilities
Vulnerability IDRelationship Description

Unspecified vulnerability in WebSphere 5.1.1 (or any earlier cumulative fix) Common Configuration Mode + CommonArchive and J2EE Models might allow attackers to obtain sensitive information via the trace.

+ Related Attack Patterns
NatureTypeIDNameDescriptionView(s) this relationship pertains toView\(s\)
ChildOfAttack PatternAttack Pattern54Probing an Application Through Targeting its Error Reporting 
Mechanism of Attack (primary)1000