The primary security vulnerability described is Information Exposure. Displaying a full stack trace in the browser reveals sensitive internal implementation details, such as function names, file paths, and framework information. An attacker can use this information to profile the application and identify potential vulnerabilities. The most direct and appropriate control is to ensure that all user-facing error messages are generic and do not contain any sensitive details. The detailed exception information should be logged securely on the server for developers to debug, but never exposed to the end-user.

A. Ensure privileges are restored after application exceptions

This control addresses privilege management issues, such as failing to de-escalate privileges in a finally block, which is unrelated to leaking information in error messages.

B. Ensure all exceptions are handled in a standardized way

While standardized exception handling is a best practice, it does not by itself solve the problem. The "standard" way could still be insecurely configured to display detailed stack traces.

C. Ensure private information is not logged

This control pertains to secure logging on the server side. The issue described is information being displayed in the browser, which is a separate concern from what is written to server logs.

---

1. OWASP Application Security Verification Standard (ASVS) v4.0.3:

Section V7.1: Error Handling: Requirement 7.1.2 states, "Verify that stack traces or other implementation details are not revealed in error messages to users." This directly supports scrubbing sensitive information from error messages.

Source Document: OWASP Application Security Verification Standard 4.0.3, Page 68.

2. NIST Special Publication 800-53, Revision 5: Security and Privacy Controls for Information Systems and Organizations:

Control SI-11: ERROR HANDLING: The control description specifies that organizations must "Generate error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries." This aligns with the principle of scrubbing sensitive details from user-facing errors.

Source Document: NIST SP 800-53 Rev. 5, Page 271.

3. MIT OpenCourseWare, 6.858 Computer Systems Security, Fall 2014:

Lecture 14: Web Security: The lecture materials emphasize the danger of information leaks from web applications. A common example cited is verbose error messages that expose stack traces, which aids attackers. The recommended mitigation is to implement custom, generic error pages.

Source: MIT OCW, 6.858 F14, Lecture 14 Notes, Section 3.1 "Information Leaks".