Summary #

Netsparker detected that the ASP.NET application trace is enabled.

Impact #

ASP.NET tracing is a powerful mechanism that helps developers debug and resolve problems in their applications, but by using the tracing, attackers can also gain information about requests and responses to the application. An attacker can obtain critical information such as:

  • Session cookies
  • Session state
  • Query string and POST variables
  • Physical path of the requested file
  • Execution time

This means that the attacker can hijack almost every active user's session by using their session details.

Actions To Take #

To disable the tracing, you need to edit the Web.config file. Open the file and change the “trace enabled” to “false” or change “localOnly” parameter to “true” (to enable tracing only on the server itself).

<system.web>
    <trace enabled="false"/>
 </system.web>

<system.web>
<trace enabled="true" localOnly="true"/>
</system.web>
Classifications #
CWE-16, 11; OWASP 2013-A5; OWASP 2017-A6 , CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Vulnerability Index

Vulnerability Index

You can search and find all vulnerabilities

OR

Search Vulnerability

Netsparker

Dead accurate, fast & easy-to-use Web Application Security Scanner

Get a demo