Technical information leak - Errors
Description
It is possible to cause the server to throw errors after analyzing the endpoints with different techniques such as: sending massive requests to the endpoint, sending massive characters in the body of the application.
Impact
Obtain technical information from the server.
Recommendation
Use generic messages to indicate server errors and avoid sending technical information.
Threat
Authorized attacker from the Internet.
Expected Remediation Time
⌚ 45 minutes.
Score
Default score using CVSS 3.1. It may change depending on the context of the vulnerability.
Base
- Attack vector: N
- Attack complexity: L
- Privileges required: L
- User interaction: N
- Scope: U
- Confidentiality: L
- Integrity: N
- Availability: N
Temporal
- Exploit code madurity: X
- Remediation level: X
- Report confidence: X
Result
- Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:X
- Score:
- Base: 4.3
- Temporal: 4.3
- Severity:
- Base: Medium
- Temporal: Medium
Code Examples
Compliant code
The response messages do not include any specific or sensitive information in the content
using System;
namespace API{
public class Program{
public static void Main(){
BuildWebHost();
}
public static IWebHost BuildWebHost() =>
WebHost.CreateDefaultBuilder()
.Build();
}
}
Non compliant code
The application uses response messages that include sensitive information
using System;
namespace API {
public class Program{
public static void Main(){
BuildWebHost();
}
public static IWebHost BuildWebHost() =>
WebHost.CreateDefaultBuilder()
.UseSetting(WebHostDefaults.DetailedErrorsKey, "true")
.Build();
}
}
Requirements
Search for vulnerabilities in your apps for free with our automated security testing! Start your 21-day free trial and discover the benefits of our Continuous Hacking Machine Plan. If you prefer a full service that includes the expertise of our ethical hackers, don't hesitate to contact us for our Continuous Hacking Squad Plan.