Improper Removal of Sensitive Information Before Storage or Transfer
Description
Improper Removal of Sensitive Information Before Storage or Transfer is a vulnerability that occurs when a product stores, transfers, or shares a resource that contains sensitive information without properly removing that data before making it available to unauthorized parties. This process of removal is commonly called "cleansing" or "scrubbing." The vulnerability manifests in various scenarios including document editors that retain hidden metadata, revision history, or comments; image files that preserve GPS coordinates and camera information in EXIF data; proxies that forward internal IP addresses in HTTP headers; and applications that fail to clear sensitive data from memory before releasing buffers. The sensitive information may not be immediately visible but remains accessible to those who know how to extract it.
Risk
Improper removal of sensitive information creates significant privacy and security risks across multiple domains. Documents shared externally may contain hidden revision history, author names, internal file paths, or confidential comments that reveal business strategies or personal information. Image EXIF metadata can expose photographers' home locations, daily patterns, and device information useful for stalking or social engineering. Applications that reuse memory buffers without proper cleansing may leak previous users' data to subsequent requests. Internal network topology exposed through HTTP headers aids attackers in mapping infrastructure for lateral movement. These leaks often go unnoticed because the sensitive data is not visible during normal use, making the exposure silent and persistent until discovered by an attacker or researcher.
Solution
Implement automated data cleansing at all boundaries where data transitions between trust zones. For documents, use metadata removal tools before external sharing and integrate cleansing into document management workflows. For images, strip EXIF data at upload time using libraries like ExifTool or built-in language functions. Configure proxies and load balancers to strip internal headers before forwarding requests externally. For memory handling, explicitly zero sensitive buffers before deallocation and use secure memory allocation libraries. Implement data loss prevention (DLP) tools that scan outgoing content for sensitive patterns. Create policies requiring data sanitization before sharing and automate enforcement. Test cleansing effectiveness by attempting to extract metadata from processed outputs.
Common Consequences
| Impact | Details |
|---|---|
| Confidentiality | Scope: Confidentiality Sensitive data may be exposed to unauthorized actors when resources are transferred between different control spheres. This includes system information such as file locations and software versions that enable targeted attacks. |
| Privacy | Scope: Confidentiality Personally Identifiable Information (PII), Private Personal Information (PPI), and other private data may be exposed, violating user privacy expectations and potentially enabling identity theft or stalking. |
Example Code
Vulnerable Code (Python)
The following code demonstrates vulnerable file handling that preserves sensitive metadata:
from PIL import Image
import shutil
import os
class VulnerableImageProcessor:
"""Processes images without removing sensitive metadata"""
def process_and_share(self, input_path, output_path):
# Vulnerable: Simply copies file, preserving all EXIF data
# EXIF may contain: GPS coordinates, camera serial, timestamps,
# thumbnail images, software version, author name
shutil.copy(input_path, output_path)
def resize_image(self, input_path, output_path, size):
# Vulnerable: PIL preserves EXIF by default in some operations
img = Image.open(input_path)
img_resized = img.resize(size)
# EXIF data may still be preserved
img_resized.save(output_path)
class VulnerableDocumentHandler:
"""Document handling with metadata exposure"""
def prepare_for_sharing(self, doc_path):
# Vulnerable: No metadata removal
# Word docs may contain:
# - Author names and company
# - Revision history with deleted text
# - Hidden comments
# - File paths revealing internal structure
# - Embedded objects with metadata
return doc_path # Just returns path, no cleansing
class VulnerableProxy:
"""Proxy that leaks internal information"""
def forward_request(self, request):
headers = dict(request.headers)
# Vulnerable: Forwards internal headers externally
# These reveal internal network topology
headers['X-Forwarded-For'] = request.remote_addr
headers['X-Real-IP'] = request.remote_addr
headers['X-Internal-Server'] = 'app-server-03.internal.corp'
headers['X-Backend-Server'] = '10.0.0.45:8080'
return self.send_external(headers, request.data)
class VulnerableBufferHandler:
"""Memory handling that leaks previous data"""
def __init__(self, buffer_size=4096):
# Reused buffer - may contain previous sensitive data
self.buffer = bytearray(buffer_size)
def process_request(self, data):
# Vulnerable: Doesn't clear buffer before use
# Previous request's data may leak if new data is shorter
for i, byte in enumerate(data):
self.buffer[i] = byte
# Rest of buffer still contains previous data!
return self.buffer
The code preserves EXIF metadata in images, doesn't cleanse documents before sharing, forwards internal network information, and reuses memory buffers without clearing.
Fixed Code (Python)
from PIL import Image
import piexif
import io
import os
class SecureImageProcessor:
"""Processes images with proper metadata removal"""
def strip_exif(self, image_path):
"""Remove all EXIF data from image"""
img = Image.open(image_path)
# Remove EXIF by loading and saving without it
data = list(img.getdata())
img_no_exif = Image.new(img.mode, img.size)
img_no_exif.putdata(data)
return img_no_exif
def process_and_share(self, input_path, output_path):
"""Process image with complete metadata removal"""
# Strip all EXIF/metadata
img = self.strip_exif(input_path)
# Save without metadata
img.save(output_path, exif=b'')
# Verify no EXIF remains
self.verify_clean(output_path)
def resize_image(self, input_path, output_path, size):
"""Resize image and ensure metadata is removed"""
img = Image.open(input_path)
img_resized = img.resize(size)
# Create new image without any metadata
img_clean = Image.new(img_resized.mode, img_resized.size)
img_clean.putdata(list(img_resized.getdata()))
# Save without EXIF
img_clean.save(output_path)
def verify_clean(self, image_path):
"""Verify image is clean of sensitive metadata"""
try:
exif_dict = piexif.load(image_path)
if any(exif_dict.values()):
raise ValueError("EXIF data still present")
except:
pass # No EXIF found - good
class SecureDocumentHandler:
"""Document handling with proper cleansing"""
SENSITIVE_PROPERTIES = [
'author', 'last_modified_by', 'company',
'comments', 'revision', 'manager'
]
def prepare_for_sharing(self, doc_path):
"""Remove metadata before sharing documents"""
from docx import Document
doc = Document(doc_path)
# Clear core properties
core_props = doc.core_properties
core_props.author = ''
core_props.last_modified_by = ''
core_props.comments = ''
core_props.revision = 1
# Remove comments from document
self.remove_comments(doc)
# Remove revision tracking
self.accept_all_changes(doc)
# Save cleaned document
clean_path = doc_path.replace('.docx', '_clean.docx')
doc.save(clean_path)
return clean_path
class SecureProxy:
"""Proxy that sanitizes headers before external forwarding"""
# Headers that should never be forwarded externally
INTERNAL_HEADERS = [
'X-Internal-Server',
'X-Backend-Server',
'X-Debug-Token',
'X-Request-Id-Internal'
]
def forward_request(self, request):
headers = {}
for key, value in request.headers:
# Skip internal headers
if key in self.INTERNAL_HEADERS:
continue
# Sanitize forwarded IPs to only include external
if key == 'X-Forwarded-For':
value = self.sanitize_ip_chain(value)
headers[key] = value
return self.send_external(headers, request.data)
def sanitize_ip_chain(self, ip_chain):
"""Remove internal IPs from X-Forwarded-For"""
ips = [ip.strip() for ip in ip_chain.split(',')]
external_ips = [ip for ip in ips if not self.is_internal(ip)]
return ', '.join(external_ips) if external_ips else ''
class SecureBufferHandler:
"""Memory handling with proper cleansing"""
def __init__(self, buffer_size=4096):
self.buffer_size = buffer_size
def process_request(self, data):
# Create fresh buffer for each request
buffer = bytearray(self.buffer_size)
# Process data
for i, byte in enumerate(data):
buffer[i] = byte
# Work with data...
result = self.process(buffer[:len(data)])
# Securely clear buffer when done
self.secure_zero(buffer)
return result
def secure_zero(self, buffer):
"""Securely zero memory to prevent data leakage"""
for i in range(len(buffer)):
buffer[i] = 0
The fix strips EXIF data from images, removes document metadata before sharing, sanitizes headers in proxies, and securely clears memory buffers.
Exploited in the Wild
NSA Document Metadata Exposure (NSA/Reality Winner, 2017)
A leaked NSA document contained hidden metadata including printer tracking dots and document properties that helped identify the leaker, Reality Winner. The document's metadata revealed the specific printer used and timestamps that narrowed down possible sources. This case demonstrated how document metadata can be forensically valuable and how failure to sanitize documents before sharing can have severe consequences.
Imgur EXIF Data Exposure (Imgur, 2019)
Security researchers discovered that Imgur, a popular image hosting service, was not consistently stripping EXIF data from uploaded images. This exposed users' GPS coordinates from smartphone photos, potentially revealing home addresses, workplaces, and travel patterns. The exposure affected millions of images before the issue was addressed.
Microsoft Office Document Metadata Leaks (Multiple Organizations, Ongoing)
Organizations routinely leak sensitive information through Microsoft Office document metadata. Case studies have revealed company mergers and acquisitions through author properties, internal network paths through embedded object links, and confidential deletions through revision history. Security researchers regularly demonstrate extracting supposedly deleted content from shared documents.
Tools to Test/Exploit
-
ExifTool — Comprehensive tool for reading, writing, and removing metadata from images, documents, and many other file types.
-
FOCA — Document metadata extraction and analysis tool for finding hidden information in publicly available documents.
-
Metadata Anonymisation Toolkit (MAT2) — Tool to remove metadata from files to help protect privacy.
CVE Examples
-
CVE-2020-26220 — CRM product failed to strip EXIF metadata from uploaded images, exposing user location data.
-
CVE-2019-3733 — Cryptography library did not clear heap memory before release, potentially leaking sensitive data.
-
CVE-2005-0406 — JPEG image editing tools left original EXIF thumbnails intact when images were modified or cropped.
-
CVE-2002-0704 — Firewall NAT feature leaked internal IP addresses in ICMP error messages forwarded externally.
References
-
MITRE Corporation. "CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer." Common Weakness Enumeration. https://cwe.mitre.org/data/definitions/212.html
-
OWASP Foundation. "Information Exposure Through Metadata." OWASP. https://owasp.org/www-community/vulnerabilities/Information_exposure_through_metadata
-
Electronic Frontier Foundation. "Printer Tracking Dots." EFF. https://www.eff.org/issues/printers
-
ExifTool Documentation. https://exiftool.org/