12
Potential Mitigations
Phase: System Configuration
Handle exceptions appropriately in source code. ASP .NET applications should be configured to
use custom error pages instead of the framework default page.
Phase: Architecture and Design
Do not attempt to process an error or attempt to mask it.
Phase: Implementation
Verify return values are correct and do not supply sensitive information about the system.
Demonstrative Examples
Example 1:
The mode attribute of the <customErrors> tag in the Web.config file defines whether custom or
default error pages are used.
In the following insecure ASP.NET application setting, custom error message mode is turned off.
An ASP.NET error message with detailed stack trace and platform versions will be returned.
Example Language: ASP.NET (Bad)
<customErrors mode="Off" />
A more secure setting is to set the custom error message mode for remote users only. No
defaultRedirect error page is specified. The local user on the web server will see a detailed stack
trace. For remote users, an ASP.NET error message with the server customError configuration
setting and the platform version will be returned.
Example Language: ASP.NET (Good)
<customErrors mode="RemoteOnly" />
Another secure option is to set the mode attribute of the <customErrors> tag to use a custom page
as follows:
Example Language: ASP.NET (Good)
<customErrors mode="On" defaultRedirect="YourErrorPage.htm" />
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 2 7PK - Environment 700 2308
MemberOf 731 OWASP Top Ten 2004 Category A10 - Insecure
Configuration Management
711 2339
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1405 Comprehensive Categorization: Improper Check or
Handling of Exceptional Conditions
1400 2531
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms ASP.NET Misconfiguration: Missing
Custom Error Handling
CWE Version 4.14
CWE-13: ASP.NET Misconfiguration: Password in Configuration File
CWE-13: ASP.NET Misconfiguration: Password in Configuration File