Description

Detects when detailed error pages are explicitly enabled in C# web applications using WebHostDefaults.DetailedErrorsKey. Displaying detailed error information in production can expose sensitive technical details, stack traces, and internal system information to potential attackers.

Detection Strategy

• Identifies calls to UseSetting() method in C# code

• Checks if WebHostDefaults.DetailedErrorsKey is set to 'true'

• Reports a vulnerability when detailed errors are explicitly enabled through this configuration setting

Vulnerable code example

using Microsoft.AspNetCore.Hosting;

public class Program
{
    public static IWebHost BuildWebHost()
    {
        return WebHost.CreateDefaultBuilder()
            .UseSetting(WebHostDefaults.DetailedErrorsKey, "true")  // Security risk: Exposes detailed error information to users...

✅ Secure code example

using Microsoft.AspNetCore.Hosting;
using Microsoft.Extensions.Hosting;

public class Program
{
    public static IWebHost BuildWebHost()
    {
        var environment = Environment.GetEnvironmentVariable("ASPNETCORE_ENVIRONMENT");...