Security review issue- Information Disclosure for third party API end point

Question

I have submitted my app for security review, which is failed due to 'Information Disclosure' issue. I am not getting how to resolve this issue.

Please, can someone guide.

Report from Salesforce: Issue Description

Revealing system data or debugging information helps an adversary learn about the system and form a plan of attack. An information leak occurs when system data or debugging information leaves the program through an output stream or logging function.

More info at https://www.owasp.org/index.php/Information_Leakage

CWE: 200 Finding 1 of 2 URL https://api.xero.com/api.xro/2.0/accounts Notes Attack Parameter: oauth_timestamp

Reproduction Steps: 1) Paste the above url in browser 2) Intercept the request using proxy tool 3) Add necessary headers other than "oauth_timestamp"

Answer 1

You would have to have Xero fix it.

The issue is their system is displaying the URL and physical path to the resource which presents a vector for an attack.

You have two options:

1. Speak with the security review team during office hours to discus your options.

2. Work with Xero to fix it. They should want to but their willingness to may not be what you would expect

SF is just trying to protect your mutual customers data.

Answer 2

This 500 error is disclosing debugging information, including the script location, server software, and programming language. This means that an attacker now knows a lot more about the system and can start trying different exploits specific to IIS, .Net, and Microsoft Windows (at minimum). If a service must display debugging information, it must restricted to only internal network IP addresses (typically 10.x.x.x IP addresses). The error should be fixed by the API provider. Also, as a nitpick, they should not be returning a 401 error when no parameters are provided (this is clearly a 400 error, since the request is malformed without the correct parameters).