An application's error page displays: 'Error in /var/www/app/models/user.rb:45:in authenticate:...

Question

An application's error page displays: 'Error in /var/www/app/models/user.rb:45:in authenticate: ActiveRecord::StatementInvalid (PG::SyntaxError: ERROR: unterminated quoted string)'. What OWASP risk does this create?

Accepted Answer

The error message reveals the framework (Rails), ORM (ActiveRecord), file system path (/var/www/app/models/user.rb:45), database type (PostgreSQL), the specific vulnerable function (authenticate), and confirms that user input reached a SQL query unescaped - confirming SQL injection vulnerability and providing a roadmap for targeted exploitation. This is OWASP A05 (Security Misconfiguration) and A09 (Logging/Monitoring Failures)

Answer

The message reveals the operating system (Linux, from the /var/www path), the web server user (www-data), the Ruby version (from the stack frame format), and the database dialect (PostgreSQL), enabling targeted exploit selection: this is A06 Vulnerable and Outdated Components (an outdated runtime), with the fix being an upgrade of Rails and PostgreSQL and a custom error handler for the production site

Answer

The error text shows that the application catches database exceptions and forwards them to the browser (a debug flag left enabled in production), and the stack trace lists source files with line numbers, giving an attacker the exact location of the failing query: this is A04 Insecure Design (no failure handling in the architecture), with the fix being a generic error page, structured server-side logging, and a review of the debug settings in the deployment pipeline

Answer

The message exposes the table schema (the users model and the authenticate method), and the SQL syntax error shows the query was built from strings, a finding that falls under A03 Injection alone: this is a code defect, with no relation to configuration or logging in the deployment of the application

An application's error page displays: 'Error in /var/www/app/models/user.rb:45:in authenticate: ActiveRecord::StatementInvalid (PG::SyntaxError: ERROR: unterminated quoted string)'. What OWASP risk does this create?

Where this fits in the Web App Fundamentals exam

One question down. Thousands to go.

An application's error page displays: 'Error in /var/www/app/models/user.rb:45:in authenticate: ActiveRecord::StatementInvalid (PG::SyntaxError: ERROR: unterminated quoted string)'. What OWASP risk does this create?

Where this fits in the Web App Fundamentals exam

More free Common Web Vulnerabilities (OWASP Intro) questions

One question down. Thousands to go.