Security Test: Frontend Stacktrace¶

Scanner(s) Support¶

Description¶

Default Severity: medium

Detailed error messages reveal too much about your system, such as which database or code libraries you're using, making it easier for attackers to find and exploit known vulnerabilities. When developers leave raw error messages accessible, they unintentionally give attackers a blueprint for targeting weaknesses in production systems, increasing the risk of a breach. It’s crucial to keep these details hidden from users and only available in internal logs for debugging purposes.

Reference:

• https://infosecwriteups.com/exploiting-error-based-sql-injections-bypassing-restrictions-ed099623cd94

Configuration¶

Identifier: frontend_information_disclosure/stacktrace

Examples¶

All configuration available:

checks:
  frontend_information_disclosure/stacktrace:
    skip: false # default

Compliance and Standards¶