Exception details written to an HTTP response
ID |
vbnet.information_leak.information_exposure_through_error_message |
Severity |
low |
Remediation Complexity |
medium |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Information Leak |
Language |
VB.NET |
Description
Exception details (a stack trace or the full ToString() of an exception) are sent to the HTTP response or returned to the caller. This discloses sensitive internal information that helps an attacker with reconnaissance. Log the exception server-side and return a generic error message to the client instead.
Rationale
Exception details (a stack trace or the full ToString() of an exception) are sent to the HTTP response or returned to the caller. This discloses sensitive internal information that helps an attacker with reconnaissance. Log the exception server-side and return a generic error message to the client instead.
The following code illustrates a vulnerable pattern detected by this rule:
Public Sub WriteToStringToResponse(ex As Exception)
' VULNERABLE: Exception details written to an HTTP response
Response.Write(ex.ToString())
End Sub