Description

Detects when the .NET Core developer exception page middleware is enabled without proper environment checks, which could expose detailed error information including stack traces in production. This creates a security risk by potentially revealing sensitive implementation details to attackers.

Detection Strategy

• Identifies calls to UseDeveloperExceptionPage() method in the application startup code

• Verifies the method is called on an IApplicationBuilder parameter which indicates middleware configuration

• Checks if the call lacks proper environment conditional checks (like IsDevelopment())

• Reports a vulnerability when the developer exception page is enabled without environment restrictions

Vulnerable code example

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    // Vulnerable: Using developer exception page without proper environment check
    app.UseDeveloperExceptionPage();
    
    app.UseHttpsRedirection();
    app.UseRouting();
}

✅ Secure code example

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    if (env.IsDevelopment())
    {
        app.UseDeveloperExceptionPage(); // Only show detailed errors in development
    }
    else 
    {...