Skip to content

Latest commit

 

History

History
39 lines (31 loc) · 1.61 KB

aspnet-tracing-enabled.md

File metadata and controls

39 lines (31 loc) · 1.61 KB
Raw
name severity cvss-score cvss-vector cwe-id cwe-name compliance
ASP.NET tracing enabled
high
9.1
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-11
ASP.NET Misconfiguration: Creating Debug Binary
HIPAA ISO 27001 owasp10 pci PCI v4.0
164.306(a)
A.5.33, A.5.34, A.8.4, A.8.9, A.8.12
A5
6.5.5
pci4-6.2.4

The ASP.NET tracing feature allows debugging of the web server interactions, by displaying full details of the requests and responses of all users visiting the site. These details are available in a well known URL that is accessible to any user, disclosing any sensitive information that is present there such as session tokens, credentials, private personal information and anything transmitted to and from the application.

An attacker that visits the ASP.NET trace page will easily hijack the accounts of any other user logged in the application just by using the session token it got there.

How to fix

{% tabs aspnet-tracing-enabled %} {% tab aspnet-tracing-enabled generic %} ASP.NET tracing is a feature of the ASP.NET framework, configured in the web.config file. To disable it, you need to edit the web.config file and change the trace directive within your system.web settings:

    <configuration>
       <system.web>
          <trace enabled="false" localOnly="true"/>
       </system.web>
    </configuration>

The localOnly="true" is a fail-safe in case the trace is enabled again. With this flag set to true, the trace page will only be available through the server itself, i.e. localhost, thus safe from requests from the Internet. {% endtab %}

{% endtabs %}