CWE-12: ASP.NET Misconfiguration: Missing Custom Error Page
ASP.NET Misconfiguration: Missing Custom Error Page
Weakness ID: 12 (Weakness Variant)
Status: Draft
Description
Description Summary
An ASP .NET application must enable custom error pages in order to prevent attackers from mining information from the framework's built-in responses.
Time of Introduction
Implementation
Operation
Applicable Platforms
Languages
.NET
Common Consequences
Scope
Effect
Confidentiality
Technical Impact: Read application
data
Default error pages gives detailed information about the error that
occurred, and should not be used in production environments.
Attackers can leverage the additional information provided by a
default error page to mount attacks targeted on the framework, database,
or other resources used by the application.
Demonstrative Examples
Example 1
An insecure ASP.NET application setting:
(Bad Code)
Example
Language: ASP.NET
<customErrors mode="Off" />
Custom error message mode is turned off. An ASP.NET error message with
detailed stack trace and platform versions will be returned.
Here is a more secure setting:
(Good Code)
Example
Language: ASP.NET
<customErrors mode="RemoteOnly" />
Custom error message mode for remote users only. No defaultRedirect
error page is specified. The local user on the web server will see a
detailed stack trace. For remote users, an ASP.NET error message with
the server customError configuration setting and the platform version
will be returned.
Potential Mitigations
Phases: System Configuration; Implementation
Handle exceptions appropriately in source code. The best practice is
to use a custom error message. Make sure that the mode attribute is set
to "RemoteOnly" in the web.config file as shown in the following
example.
(Good Code)
<customErrors mode="RemoteOnly" />
The mode attribute of the <customErrors> tag in the
Web.config file defines whether custom or default error pages are used.
It should be configured to use a custom page as follows:
Description
