Skip to main content

Technical information leak - Errors

Description

It is possible to cause the server to throw errors after analyzing the endpoints with different techniques such as: sending massive requests to the endpoint, sending massive characters in the body of the application.

Impact

Obtain technical information from the server.

Recommendation

Use generic messages to indicate server errors and avoid sending technical information.

Threat

Authorized attacker from the Internet.

Expected Remediation Time

⌚ 45 minutes.

Score

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base

  • Attack vector: N
  • Attack complexity: L
  • Privileges required: L
  • User interaction: N
  • Scope: U
  • Confidentiality: L
  • Integrity: N
  • Availability: N

Temporal

  • Exploit code madurity: X
  • Remediation level: X
  • Report confidence: X

Result

  • Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:X
  • Score:
    • Base: 4.3
    • Temporal: 4.3
  • Severity:
    • Base: Medium
    • Temporal: Medium

Code Examples

Compliant code

The response messages do not include any specific or sensitive information in the content

using System;
namespace API{
public class Program{
public static void Main(){
BuildWebHost();
}
public static IWebHost BuildWebHost() =>
WebHost.CreateDefaultBuilder()
.Build();
}
}

Non compliant code

The application uses response messages that include sensitive information

using System;
namespace API {
public class Program{
public static void Main(){
BuildWebHost();
}
public static IWebHost BuildWebHost() =>
WebHost.CreateDefaultBuilder()
.UseSetting(WebHostDefaults.DetailedErrorsKey, "true")
.Build();
}
}

Requirements

free trial

Search for vulnerabilities in your apps for free with our automated security testing! Start your 21-day free trial and discover the benefits of our Continuous Hacking Machine Plan. If you prefer a full service that includes the expertise of our ethical hackers, don't hesitate to contact us for our Continuous Hacking Squad Plan.