ASP.NET tracing enabled
Summary: ASP.NET tracing, a debugging feature meant for development, discloses sensitive information to users when left enabled in production. Application-level tracing lets any user retrieve full details of recent requests, including those of other users, typically session tokens and request parameters, while page-level tracing returns the same information for only the current request.
Key Takeaway: With application-level tracing on, session tokens and request parameters from other users are exposed to anyone who asks, which can let an attacker compromise other users and even take control of the entire application. Disabling it in Web.config does not fully close the gap, since individual pages can still turn on page-level tracing through the Page directive or application code.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026