A currency-convert tool in Ravens Ops is running with debug mode on in production. Input it does not expect makes it throw, and the verbose error page prints the stack trace along with the environment variables, which include a signing secret.
The currency-convert tool computes a result for a numeric amount. Debug mode is mistakenly on in production, so any non-numeric input causes an error that prints a verbose trace including the environment variables, where the secret lives.
Extract the signing secret from the verbose error page.
You extracted the signing secret from the verbose trace.
Why the solution worked
Debug mode in production reveals internal details to the user: file paths, server state and environment variables. Error messages must be generic to the user and detailed only in the internal log.
The root cause
Debug mode is on in production, so error messages leak environment variables. The root is an unhardened production configuration that exposes internals.
How the code is fixed
Disable debug in production; return a generic message to the user and keep details in the internal log.
Vulnerable code
app.use((err, req, res, next) => {
// Debug on in production: the client gets the whole stack and the environment.
res.status(500).json({ error: err.message, trace: err.stack, env: process.env });
});
Safe code
app.use((err, req, res, next) => {
logger.error(err); // full detail to the internal log only
res.status(500).json({ error: 'Internal error' }); // generic to the client
});
Impact in the real world
Verbose errors leak secrets, paths and versions that ease later attacks, and have leaked keys and database connection details.
How defenders detect it
Defenders disable debug in production, return generic error messages, and alert on error pages containing traces or environment variables.
