What is ASP.NET Misconfiguration: Missing Custom (CWE-12)?

TL;DR: ASP.NET Misconfiguration: Missing Custom Error Page (CWE-12) is a critical vulnerability that occurs when an ASP .NET application fails to enable custom error pages, allowing attackers to mine information from the framework’s built-in responses.

What is ASP.NET Misconfiguration: Missing Custom Error Page?

ASP.NET Misconfiguration: Missing Custom Error Page (CWE-12) is a type of vulnerability that occurs when an ASP .NET application fails to enable custom error pages, allowing attackers to mine information from the framework’s built-in responses. As defined by the MITRE Corporation under CWE-12, and classified by the OWASP Foundation as Not directly mapped.

Quick Summary

ASP.NET Misconfiguration: Missing Custom Error Page (CWE-12) is a critical vulnerability that can lead to exposure of sensitive data, potential for unauthorized access, and reputational damage. It occurs when an ASP .NET application fails to enable custom error pages, allowing attackers to mine information from the framework’s built-in responses.

Jump to: Quick Summary · ASP.NET Misconfiguration: Missing Custom Error Page Overview · Business Impact of ASP.NET Misconfiguration: Missing Custom Error Page · ASP.NET Misconfiguration: Missing Custom Error Page Attack Scenario · How to Detect ASP.NET Misconfiguration: Missing Custom Error Page · How to Fix ASP.NET Misconfiguration: Missing Custom Error Page · How to Ask AI to Check Your Code for ASP.NET Misconfiguration: Missing Custom Error Page · ASP.NET Misconfiguration: Missing Custom Error Page Best Practices Checklist · ASP.NET Misconfiguration: Missing Custom Error Page FAQ · Vulnerabilities Related to ASP.NET Misconfiguration: Missing Custom Error Page · References · Scan Your Own Site

ASP.NET Misconfiguration: Missing Custom Error Page Overview

ASP.NET Misconfiguration: Missing Custom Error Page (CWE-12) is a critical vulnerability that can lead to exposure of sensitive data, potential for unauthorized access, and reputational damage. It occurs when an ASP .NET application fails to enable custom error pages, allowing attackers to mine information from the framework’s built-in responses.

How ASP.NET Misconfiguration: Missing Custom Error Page Works

Root Cause

The root cause of this vulnerability is the failure to configure ASP .NET applications to use custom error pages instead of the framework default page.

Attack Flow

1. The attacker sends a request to the ASP .NET application that triggers an error.
2. The ASP .NET application returns a default error page, which contains sensitive information about the application and its configuration.
3. The attacker uses this information to launch further attacks against the application.

Prerequisites to Exploit

• The ASP .NET application must be configured to use the framework default error page instead of custom error pages.
• The attacker must have access to the application’s error pages.

Vulnerable Code

public void HandleError(Exception ex)
{
    Response.StatusCode = 500;
    Response.Write(ex.Message);
}

This code demonstrates a vulnerable ASP .NET application that returns the framework default error page, containing sensitive information about the application and its configuration.

Secure Code

public void HandleError(Exception ex)
{
    Response.StatusCode = 500;
    Response.Redirect("~/custom-error-page.html");
}

This code demonstrates a secure ASP .NET application that redirects to a custom error page instead of returning the framework default error page.

Business Impact of ASP.NET Misconfiguration: Missing Custom Error Page

The business impact of ASP.NET Misconfiguration: Missing Custom Error Page includes exposure of sensitive data, potential for unauthorized access, and reputational damage. This can lead to financial losses, compliance issues, and damage to an organization’s reputation.

Confidentiality

• Exposure of sensitive data, such as database credentials or API keys.
• Potential for unauthorized access to sensitive areas of the application.

Integrity

• Modification of sensitive data, such as user passwords or configuration files.
• Potential for denial-of-service attacks against the application.

Availability

• Disruption of service due to excessive error page requests.
• Potential for data loss or corruption due to incorrect handling of errors.

ASP.NET Misconfiguration: Missing Custom Error Page Attack Scenario

Here is a step-by-step walkthrough of an attack scenario:

1. The attacker sends a request to the ASP .NET application that triggers an error.
2. The ASP .NET application returns a default error page, which contains sensitive information about the application and its configuration.
3. The attacker uses this information to launch further attacks against the application.

How to Detect ASP.NET Misconfiguration: Missing Custom Error Page

Manual Testing

• Trigger an unhandled exception (e.g. request a URL with malformed input) and check whether the response is web.config’s custom error page or the raw ASP.NET yellow-screen-of-death stack trace.
• Check web.config for <customErrors mode="On"/> or mode="RemoteOnly" (the latter only hides errors from remote clients, not localhost — confirm which is intended).
• Confirm the custom error page itself doesn’t echo back request data or exception details.

Automated Scanners (SAST / DAST)

Static analysis can check whether web.config sets <customErrors mode="On"/>; dynamic testing is needed to confirm the deployed application actually serves that page instead of the framework default when a real unhandled exception occurs at runtime.

PenScan Detection

PenScan’s Nikto and ZAP engines actively probe for the ASP.NET default error page and stack-trace disclosure in HTTP responses.

False Positive Guidance

A finding on a non-production/staging deployment that intentionally leaves detailed errors on for debugging isn’t a real issue there — confirm the target is a production or production-configured environment before treating it as a finding.

How to Fix ASP.NET Misconfiguration: Missing Custom Error Page

Here are some potential mitigations:

• Configure your ASP .NET application to use custom error pages instead of the framework default page.
• Handle exceptions appropriately in source code, without echoing exception details back in the response.

Framework-Specific Fixes for ASP.NET Misconfiguration: Missing Custom Error Page

// In web.config
<customErrors mode="On" />

This code demonstrates a secure configuration for ASP .NET applications that use custom error pages instead of the framework default page.

How to Ask AI to Check Your Code for ASP.NET Misconfiguration: Missing Custom Error Page

You can ask AI to check your code for ASP.NET Misconfiguration: Missing Custom Error Page by providing a code block that demonstrates the vulnerability and asking the AI to rewrite it using a primary fix technique. Here is an example:

// Vulnerable code
public void HandleError(Exception ex)
{
    Response.StatusCode = 500;
    Response.Write(ex.Message);
}

// Secure code
public void HandleError(Exception ex)
{
    Response.StatusCode = 500;
    Response.Redirect("~/custom-error-page.html");
}

ASP.NET Misconfiguration: Missing Custom Error Page Best Practices Checklist

Here are some best practices for preventing ASP.NET Misconfiguration: Missing Custom Error Page:

• Verify return values are correct.
• Configure your ASP .NET application to use custom error pages instead of the framework default page.
• Handle exceptions appropriately in source code.

ASP.NET Misconfiguration: Missing Custom Error Page FAQ

How is ASP.NET Misconfiguration: Missing Custom Error Page defined?

ASP.NET Misconfiguration: Missing Custom Error Page (CWE-12) is a type of vulnerability that occurs when an ASP .NET application fails to enable custom error pages, allowing attackers to mine information from the framework’s built-in responses.

What is the business impact of ASP.NET Misconfiguration: Missing Custom Error Page?

The business impact of ASP.NET Misconfiguration: Missing Custom Error Page includes exposure of sensitive data, potential for unauthorized access, and reputational damage.

How can I detect ASP.NET Misconfiguration: Missing Custom Error Page in my application?

You can detect ASP.NET Misconfiguration: Missing Custom Error Page by manually testing your application’s error pages or using automated scanners that check for missing custom error pages.

What are the potential mitigations for ASP.NET Misconfiguration: Missing Custom Error Page?

The potential mitigations for ASP.NET Misconfiguration: Missing Custom Error Page include handling exceptions appropriately in source code, configuring ASP .NET applications to use custom error pages instead of the framework default page, and verifying return values are correct.

What is the relationship between CWE-12 and CWE-756?

CWE-12 (ASP.NET Misconfiguration: Missing Custom Error Page) is a more specific variant of CWE-756 (Missing Custom Error Page).

How can I fix ASP.NET Misconfiguration: Missing Custom Error Page in my application?

You can fix ASP.NET Misconfiguration: Missing Custom Error Page by configuring your ASP .NET application to use custom error pages and handling exceptions appropriately in source code.

What are the best practices for preventing ASP.NET Misconfiguration: Missing Custom Error Page?

The best practices for preventing ASP.NET Misconfiguration: Missing Custom Error Page include verifying return values are correct, configuring ASP .NET applications to use custom error pages instead of the framework default page, and handling exceptions appropriately in source code.

How can I ask AI to check my code for ASP.NET Misconfiguration: Missing Custom Error Page?

You can ask AI to check your code for ASP.NET Misconfiguration: Missing Custom Error Page by providing a code block that demonstrates the vulnerability and asking the AI to rewrite it using a primary fix technique.

Vulnerabilities Related to ASP.NET Misconfiguration: Missing Custom Error Page

References

• MITRE CWE-12
• CAPEC None known
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find ASP.NET Misconfiguration: Missing Custom Error Page and other risks before an attacker does.