CWE-12: ASP.NET Misconfiguration: Missing Custom Error Page
ASP.NET Misconfiguration: Missing Custom Error Page
Weakness ID: 12 (Weakness Variant)
Status: Draft
Description
Description Summary
An ASP .NET application must enable custom error pages in order to prevent attackers from mining information from the framework's built-in responses.
Time of Introduction
Implementation
Operation
Applicable Platforms
Languages
.NET
Common Consequences
Scope
Effect
Confidentiality
Technical Impact: Read application
data
Default error pages gives detailed information about the error that
occurred, and should not be used in production environments.
Attackers can leverage the additional information provided by a
default error page to mount attacks targeted on the framework, database,
or other resources used by the application.
Demonstrative Examples
Example 1
An insecure ASP.NET application setting:
(Bad Code)
Example
Language: ASP.NET
<customErrors mode="Off" />
Custom error message mode is turned off. An ASP.NET error message with
detailed stack trace and platform versions will be returned.
Here is a more secure setting:
(Good Code)
Example
Language: ASP.NET
<customErrors mode="RemoteOnly" />
Custom error message mode for remote users only. No defaultRedirect
error page is specified. The local user on the web server will see a
detailed stack trace. For remote users, an ASP.NET error message with
the server customError configuration setting and the platform version
will be returned.
Potential Mitigations
Handle exceptions appropriately in source code. The best practice is
to use a custom error message. Make sure that the mode attribute is set
to "RemoteOnly" in the web.config file as shown in the following
example.
(Good Code)
<customErrors mode="RemoteOnly" />
The mode attribute of the <customErrors> tag in the Web.config
file defines whether custom or default error pages are used. It should
be configured to use a custom page as follows:
Description
