Trace.axd Detected

Severity: High

Summary#

Invicti detected that ASP.NET tracing is enabled and Trace.axd is accessible remotely.

This vulnerability can be used to obtain sensitive data on current sessions.

Impact#

ASP.NET's trace feature is a powerful mechanism that helps developers debug and resolve problems in their applications, but it can also be used by attackers to gain information about requests and responses to the application. An attacker can obtain information such as:

Session cookies
Session state
Query string and POST variables
Physical path of the requested file
Execution time

This means that the attacker can hijack almost every active user's session by using their session details.

Remediation#

Apply the following changes on your web.config file to disable ASP.NET tracing:

<System.Web>
     <trace enabled="false" />
</System.Web>

Classifications#

WASC-15, PCI v3.2-6.5.6, CAPEC-347, CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C, OWASP 2017-A6, ISO27001-A.18.1.3, HIPAA-164.306(a), 164.308(a), OWASP 2013-A5, CWE-16

Select Category

Search Vulnerability

Trace.axd Detected

Related Articles

Build your resistance to threats. And save hundreds of hours each month.