使用 OWASP ZAP 2.8.0 进行自动扫描后,我有带有 javascript 文件(moxiejs 库)的“应用程序错误披露”。网站基于更新到最新版本的 wordpress。如何修复这个漏洞?还是误报?
Medium (Medium) Application Error Disclosure
Description
This page contains an error/warning message that may disclose sensitive information like the location of the file that produced the unhandled exception. This information can be used to launch further attacks against the web application. The alert could be a false positive if the error message is found inside a documentation page.
URL http://x.x.x.x/wordpress/wp-includes/js/plupload/moxie.min.js?ver=1.3.5
Method GET
Evidence Internal Server Error
Instances 1
Solution
Review the source code of this page. Implement custom error pages. Consider implementing a mechanism to provide a unique error reference/identifier to the client (browser) while logging the details on the server side and not exposing them to the user.
Reference
CWE Id 200
WASC Id 13
Source ID 3
我发现 moxiejs 脚本包含字符串“内部服务器错误”,例如(https://raw.githubusercontent.com/WordPress/WordPress/master/wp-includes/js/plupload/moxie.min.js)。ZAP 是否通过搜索错误文本进行检查?