Web Application Information Disclosure

Tenable plugin 57640 is a generic web-app finding, not a product-specific CVE. It fires when a malformed HTTP request makes the application return physical filesystem paths or similar internal error details in the response, such as Windows paths like C:\inetpub\... or Linux paths like /var/www/.... There is no clean version range because the issue is endpoint- and configuration-specific: any web application or framework can be affected if verbose errors, stack traces, or debug responses are exposed to unauthenticated users.

The vendor's MEDIUM label is understandable if you score the leak in isolation, but at enterprise patch-priority scale it is usually too high. This bug normally provides reconnaissance value only: it helps attackers tune a later LFI, path traversal, file disclosure, or framework-specific exploit, but it rarely changes the game on its own. For a 10,000-host estate, this belongs in hardening/backlog hygiene, not emergency patch motion, unless the leaking app is internet-facing and already has a second exploitable flaw.

Why this verdict

• Requires only recon value, not direct impact — the plugin describes path disclosure after malformed requests, which usually yields environment clues rather than immediate file read, auth bypass, or code execution.
• Follow-on bug required — to become materially dangerous, the attacker typically needs LFI, traversal, source disclosure, unsafe upload handling, or another app-specific flaw to chain with the leaked path.
• Reachable population is narrower than it looks — modern production apps often hide stack traces behind generic error pages, reverse proxies, or framework defaults, so many real deployments will not expose useful path details even when scanners hit odd endpoints.
• Modern controls should stop or blunt it — custom error pages, debug-off production configs, WAF normalization, and secure framework defaults all reduce practical exploitability.
• Blast radius is local to the application — even when real, the leak usually helps target one app more precisely; it is not an estate-wide privilege escalator.

Why not higher?

There is no evidence here of direct confidentiality loss beyond environmental metadata, and no proof of a weaponized chain attached to the finding. If you cannot show a second reachable bug that becomes easier because of the leaked path, MEDIUM or HIGH is inflation.

Why not lower?

This is not pure noise. Physical path leakage does help attackers fingerprint the stack, refine traversal depth, and target configuration files or source paths more efficiently, especially on internet-facing legacy apps. It deserves cleanup and verification, just not high-priority patch treatment.

1. Force generic error pages — Return uniform 4xx/5xx responses and suppress backend exception text so clients never see filesystem paths or stack traces. For a LOW verdict there is no SLA; treat this as backlog hygiene and complete it in the next planned web hardening cycle.
2. Disable debug and stack traces in production — Review framework settings for ASP.NET, Spring, Django, PHP, Node, and reverse-proxy error passthrough so production never exposes verbose diagnostics. For LOW, there is no formal mitigation deadline; fix during normal release governance.
3. Log server-side, not client-side — Keep detailed exception data in protected logs or APM backends, not in HTTP responses. That preserves troubleshooting value while removing attacker-visible recon; schedule as standard app-hardening work.
4. Retest with DAST after changes — After changing error handling, rerun the scanner or a targeted probe to confirm that malformed requests now return generic responses. Since this is LOW, verification can follow your normal application QA cadence.

Run this from an auditor workstation or CI runner that can reach the target URL over HTTP/S. Invoke it as python3 check_path_disclosure.py https://app.example.com/ with no special privileges; add a full path like https://app.example.com/login if you want to test a specific endpoint.

#!/usr/bin/env python3
# check_path_disclosure.py
# Probe a web application for path / stack-trace disclosure via malformed requests.
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / error

import re
import sys
import requests
from urllib.parse import urljoin

TIMEOUT = 10
HEADERS = {
    'User-Agent': 'noisgate-path-disclosure-check/1.0',
    'Accept': '*/*'
}

PATH_PATTERNS = [
    re.compile(r'[A-Za-z]:\\\\(?:[^\\\\\r\n]+\\\\)*[^\\\\\r\n]*'),   # Windows path
    re.compile(r'/(?:var|srv|opt|home|usr|etc|tmp|app|www)/(?:[^\s"<>:]*)'),         # Unix path
    re.compile(r'inetpub\\\\wwwroot', re.I),
    re.compile(r'/var/www', re.I),
    re.compile(r'/usr/local/', re.I),
]

STACK_PATTERNS = [
    re.compile(r'Traceback \(most recent call last\):'),
    re.compile(r' at [A-Za-z0-9_$.]+\([A-Za-z0-9_$.]+:\d+\)'),      # Java-ish stack trace
    re.compile(r'System\.[A-Za-z0-9_.]+Exception', re.I),
    re.compile(r'Fatal error:', re.I),
    re.compile(r'Warning: .* on line \d+', re.I),
    re.compile(r'<b>Stack trace</b>', re.I),
]

PROBES = [
    ('GET', ''),
    ('GET', "'\"<>{}..;/"),
    ('GET', 'nonexistent-noisgate-__trigger__-404'),
    ('GET', '?id=%27%22%3C%3E%7B%7D'),
]


def fetch(url, method='GET'):
    try:
        if method == 'GET':
            r = requests.get(url, headers=HEADERS, timeout=TIMEOUT, allow_redirects=True, verify=True)
        else:
            r = requests.request(method, url, headers=HEADERS, timeout=TIMEOUT, allow_redirects=True, verify=True)
        return r
    except requests.RequestException:
        return None


def analyze(body):
    findings = []
    for pat in PATH_PATTERNS:
        m = pat.search(body)
        if m:
            findings.append(f'path:{m.group(0)[:160]}')
    for pat in STACK_PATTERNS:
        m = pat.search(body)
        if m:
            findings.append(f'stack:{m.group(0)[:160]}')
    return findings


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python3 check_path_disclosure.py https://target/')
        sys.exit(2)

    base = sys.argv[1].strip()
    if not base.startswith('http://') and not base.startswith('https://'):
        print('UNKNOWN - target must start with http:// or https://')
        sys.exit(2)

    hits = []
    tested = 0

    for method, suffix in PROBES:
        target = urljoin(base if base.endswith('/') else base + '/', suffix)
        r = fetch(target, method=method)
        if r is None:
            continue
        tested += 1
        body = r.text[:200000]
        findings = analyze(body)
        if findings:
            hits.append({'url': target, 'status': r.status_code, 'findings': findings[:5]})

    if hits:
        print('VULNERABLE')
        for hit in hits:
            print(f"URL={hit['url']} STATUS={hit['status']} FINDINGS={'; '.join(hit['findings'])}")
        sys.exit(1)

    if tested == 0:
        print('UNKNOWN - no successful HTTP responses received')
        sys.exit(2)

    print('PATCHED')
    print('No obvious path or stack-trace disclosure detected in tested responses.')
    sys.exit(0)


if __name__ == '__main__':
    main()

Sources

1. Tenable Nessus Plugin 57640
2. MITRE CWE-209
3. OWASP Error Handling Cheat Sheet
4. OWASP WSTG: Testing for Improper Error Handling
5. OWASP Path Traversal
6. OWASP ZAP Alert: Internal file path disclosure
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS FAQ