Description

Detects .NET web applications with debugging enabled in production configurations. When debug mode is set to "true" in web.config files, it can expose sensitive technical details to attackers, including file paths, variable values, and detailed error messages that aid in exploiting vulnerabilities.

Detection Strategy

• Search for web.config files in the codebase

• Look for <system.web> configuration sections within the file

• Check if there are any <compilation> tags with debug="true" attribute

• Flag configurations where debug mode is explicitly enabled

Vulnerable code example

<!-- Web.config -->
<configuration>
    <system.web>
        <compilation
            defaultLanguage="c#"
            debug="true"  <!-- SECURITY: Debug mode enabled exposes sensitive info like stack traces -->
        />
    </system.web>...

✅ Secure code example

<!-- Web.config -->
<configuration>
    <system.web>
        <compilation
            defaultLanguage="c#"
            debug="false"  <!-- Debug disabled to prevent exposure of sensitive details -->
        />
        <customErrors mode="On"/>  <!-- Forces custom error pages instead of detailed error messages -->...