Medium severityC#Insecure ConfigurationHIGH confidence

Customerrors Off

ASP.NET custom errors are disabled (<customErrors mode="Off">), so detailed framework error pages and stack traces are shown to clients (CWE-12/CWE-209).

Standards mapping

CWE: CWE-209: Generation of Error Message Containing Sensitive Information CWE-756: Missing Custom Error Page
OWASP Top 10: A05:2021 - Security Misconfiguration
OWASP ASVS: V14.3.2 (L1)

Vulnerable vs. safe

Flagged by this check

<customErrors mode="Off" />

Passes - the safe pattern

<customErrors mode="On" defaultRedirect="~/Error" />

Why it matters & how to fix it

ASP.NET custom errors are disabled (<customErrors mode="Off">), so detailed framework error pages and stack traces are shown to clients (CWE-12/CWE-209). Set mode="On" (or "RemoteOnly") in production with a defaultRedirect to a generic error page.

References

Rule ID integsec.csharp.insecure-config.customerrors-off - engine: Opengrep - license: MIT - Copyright (c) IntegSec Inc.

TurboPentest runs this check automatically

Connect a GitHub repo and this check runs on every white-box pentest - AI-validated and reported with proof, from $99 per target.

Start a pentest

Related checks