CWE-12 ASP.NET Misconfiguration: Missing Custom Error Page

An ASP .NET application must enable custom error pages in order to prevent attackers from mining information from the framework's built-in responses.

• Confidentiality: Read Application Data — Default error pages gives detailed information about the error that occurred, and should not be used in production environments. Attackers can leverage the additional information provided by a default error page to mount attacks targeted on the framework, database, or other resources used by the application.

• [System Configuration] Handle exceptions appropriately in source code. ASP .NET applications should be configured to use custom error pages instead of the framework default page. • [Architecture and Design] Do not attempt to process an error or attempt to mask it. • [Implementation] Verify return values are correct and do not supply sensitive information about the system.

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)