[SECURITY] Technical information disclosure in stack traces of error pages

[mlarcelet]

Describe the security issue
The application discloses technical internal information about the technologies or components used in
the error pages. CWE-209,CWE-200

Vulnerability Location
Stack traces on MirthConnect web portal and API

Environment

• OS: Ubuntu 20.04.1 LTS (GNU/Linux 5.4.0-122-generic x86_64)
• Java Distribution/Version : OpenJDK Runtime Environment (build 1.8.0_312-8u312-b07-0ubuntu1~20.04-b07)
• Connect Version : 4.01

Suggested remediation
Review the configuration of the application to prevent stack traces.
Declare default error page for a specific error code in the WEB-INF/web.xml configuration file

Jetty Create Custom error pages
OWASP Error handling cheat sheet
OWASP Web Security Testing Guide - Information gathering step
PortSwigger Information disclosure vulnerabilities