Stack trace written to an HTTP response
ID |
vbnet.information_leak.information_exposure_through_error_message |
Severity |
high |
Remediation Complexity |
medium |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Information Leak |
Language |
VB.NET |
Description
A stack trace (the StackTrace or the full ToString() of an exception) is sent to the HTTP response. This discloses file paths, frameworks and code structure to whoever sent the request. Log the exception server-side and return a generic error message to the client instead.
Rationale
A stack trace (the StackTrace or the full ToString() of an exception) is sent to the HTTP response. This discloses file paths, frameworks and code structure to whoever sent the request. Log the exception server-side and return a generic error message to the client instead.
The response is a write to a *.Response (Response.Write, Response.WriteAsync), an ASP.NET action result
(BadRequest, StatusCode, Ok, Content, Problem…), or a value returned by a controller or page class.
Logging the exception server-side is the recommended remediation and is not reported, nor is a helper returning
ex.ToString() outside a controller / page.
The following code illustrates a vulnerable pattern detected by this rule:
Public Class ObjectsController
Inherits ControllerBase
Public Function GetObject(id As String) As IActionResult
Try
Return Ok(Resolve(id))
Catch ex As Exception
' VULNERABLE: stack trace returned to the caller
Return BadRequest(ex.ToString())
End Try
End Function
End ClassRemediation
Follow secure coding practices and review the references below for detailed remediation guidance.