10
The debug attribute of the <compilation> tag defines whether compiled binaries should include
debugging information. The use of debug binaries causes an application to provide as much
information about itself as possible to the user.
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
Attackers can leverage the additional information they
gain from debugging output to mount attacks targeted on
the framework, database, or other resources used by the
application.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: System Configuration
Avoid releasing debug binaries into the production environment. Change the debug mode to
false when the application is deployed into production.
Demonstrative Examples
Example 1:
The file web.config contains the debug mode setting. Setting debug to "true" will let the browser
display debugging information.
Example Language: XML (Bad)
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<system.web>
<compilation
defaultLanguage="c#"
debug="true"
/>
...
</system.web>
</configuration>
Change the debug mode to false when the application is deployed into production.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 2 7PK - Environment 700 2308
MemberOf 731 OWASP Top Ten 2004 Category A10 - Insecure
Configuration Management
711 2339
CWE Version 4.14
CWE-12: ASP.NET Misconfiguration: Missing Custom Error Page
CWE-12: ASP.NET Misconfiguration: Missing Custom Error Page