ELMAH (Error Logging Modules and Handlers) is an application error logging facility. This application is not properly configured and leads to information disclosure via elmah.axd or errorlog.axd. This allows an unauthenticated, remote attacker to view web requests made to the server, including sensitive information like Session ID values, full path or request variables.

Scanner has detected server-side source code within the server's response.

A modern web application will be reliant on several different programming languages. These languages can be broken up in two flavours. These are client-side languages (such as those that run in the browser -- like JavaScript) and server-side languages (which are executed by the server -- like ASP, PHP, JSP, etc.) to form the dynamic pages (client-side code) that are then sent to the client.

Because all server side code should be executed by the server, it should never be seen by the client, however in some scenarios it is possible that the server has a misconfiguration or the server side code has syntax errors, and therefore is not executed by the server but is instead sent to the client. As the server-side source code often contains sensitive information, such as database connection strings or details into the application workflow, this can be extremely risky.

Cyber-criminals will attempt to discover pages that either accidentally or forcefully allow the server-side source code to be disclosed, to assist in discovering further vulnerabilities or sensitive information.

The web server on the remote host allows read access to files within a 'CVSROOT' directory exposing files tracked inside. This potential flaw can be used to access content from the web server that might otherwise be private & permit download of the source code of listed pages hosted on the remote server.

The web server on the remote host allows read access to files within a 'CVS' directory exposing files tracked inside. This potential flaw can be used to access content from the web server that might otherwise be private.

The web server on the remote host allows read access to files within a '.svn' directory exposing files tracked inside. This potential flaw can be used to access content from the web server that might otherwise be private & permit download of the source code of listed pages hosted on the remote server.

The web server on the remote host allows read access to a OSX .DS_Store file. This potential flaw can be used to access content from the web server that might otherwise be private.

The US Social Security Number (SSN) is a personally identifiable number that is issued to its citizens. A stolen or leaked SSN can lead to a compromise, and/or the theft of the affected individuals identity. WAS has discovered an SSN located within the response of the affected page

The web server on the remote host contains publically accessible WS_FTP log files. These log files are produced by WS_FTP and contain details of source/destination file names, date of upload and other potentially sensitive information. This may be used to access content from the web server that might otherwise be private.

An error or warning message has been found on the remote web server. It may be possible for an attacker to view sensitive information and conduct further attacks.

The web server on the remote host contains gitignore configuration files. This potential flaw can be used to access content from the web server that might otherwise be private.

An information disclosure vulnerability exists in the remote web server due to the disclosure of the web.config file. An unauthenticated, remote attacker can exploit this, via a simple GET request, to disclose potentially sensitive configuration information.

The web server on the remote host allows read access to a Git repository. This potential flaw can be used to access content from the web server that might otherwise be private.

The remote web server contains an application which is affected by a path disclosure issue. It may be possible for an attacker to view full path names and conduct further attacks.

Credit card numbers are used in applications where a user is able to purchase goods and/or services.

A credit card number is a sensitive piece of information and should be handled as such. Cyber-criminals will use various methods to attempt to compromise credit card information that can then be used for fraudulent purposes.

Through the use of regular expressions and CC number format validation using known issuer numbers and luhn check validation, the scanner was able to discover a credit card number located within the affected page.

Scanner has detected server-side source code within the server's response.

A modern web application will be reliant on several different programming languages. These languages can be broken up in two flavours. These are client-side languages (such as those that run in the browser -- like JavaScript) and server-side languages (which are executed by the server -- like ASP, PHP, JSP, etc.) to form the dynamic pages (client-side code) that are then sent to the client.

Because all server side code should be executed by the server, it should never be seen by the client, however in some scenarios, using crafted requests it is possible to force the server into displaying the source code of the application without executing it. As the server-side source code often contains sensitive information, such as database connection strings or details into the application workflow, this can be extremely risky.

Cyber-criminals will attempt to discover pages that either accidentally or forcefully allow the server-side source code to be disclosed, to assist in discovering further vulnerabilities or sensitive information.

Concurrent Version System (CVS) and Subversion (SVN) provide a method for application developers to control different versions of their code.

Occasionally, the developer's version or user information can be stored incorrectly within the code and may be visible to the end user (either in the HTML or code comments). As one of the initial steps in information gathering, cyber-criminals will spider a website and using automated methods attempt to discover any CVS/SVN information that may be present in the page.

This will aid them in developing a better understanding of the deployed application (potentially through the disclosure of version information), or it may assist in further information gathering or social engineering attacks.

Using the same automated methods, scanner was able to detect CVS or SVN details stored within the affected page.

Email addresses are typically found on "Contact us" pages, however, they can also be found within scripts or code comments of the application. They are used to provide a legitimate means of contacting an organisation.

As one of the initial steps in information gathering, cyber-criminals will spider a website and using automated methods collect as many email addresses as possible, that they may then use in a social engineering attack.

Using the same automated methods, scanner was able to detect one or more email addresses that were stored within the affected page.

Private, or non-routable, IP addresses are generally used within a home or company network and are typically unknown to anyone outside of that network.

Cyber-criminals will attempt to identify the private IP address range being used by their victim, to aid in collecting further information that could then lead to a possible compromise.

Scanner discovered that the affected page returned a RFC 1918 compliant private IP address and therefore could be revealing sensitive information.

This finding typically requires manual verification to ensure the context is correct, as any private IP address within the HTML body will trigger it.

A common practice when administering web applications is to create a copy/backup of a particular file or directory prior to making any modification to the file. Another common practice is to add an extension or change the name of the original file to signify that it is a backup (examples include `.bak`, `.orig`, `.backup`, etc.).

During the initial recon stages of an attack, cyber-criminals will attempt to locate backup files by adding common extensions onto files already discovered on the webserver. By analysing the response headers from the server they are able to determine if the backup file exists. These backup files can then assist in the compromise of the web application.

By utilising the same method, scanner was able to discover a possible backup file.

A common practice when administering web applications is to create a copy/backup of a particular directory prior to making any modification. Another common practice is to add an extension or change the name of the original directory to signify that it is a backup (examples include `.bak`, `.orig`, `.backup`, etc.).

During the initial recon stages of an attack, cyber-criminals will attempt to locate backup directories by adding common extensions onto directories already discovered on the webserver. By analysing the response headers from the server they are able to determine if a backup directory exists. These backup directories can then assist in the compromise of the web application.

By utilising the same method, scanner was able to discover a possible backup directory.

ID	Name	Severity
112425	ELMAH elmah.axd/errorlog.axd Information Disclosure	Medium
98779	Source Code Leakage	Medium
98680	CVS Repository Detected	Medium
98671	CVS Entries Detected	Medium
98650	SVN Repository Detected	Medium
98646	.DS_Store File Detected	Medium
98920	Disclosed US Social Security Number	Medium
98632	WS_FTP.LOG File Detected	Medium
98611	Error Message	Info
98595	Gitignore File Detected	Medium
98594	Web.config File Information Disclosure	Medium
112531	Git Repository Detected	Medium
112550	Full Path Disclosure	Info
98129	Credit card number disclosure	Medium
98098	Source Code Disclosure	Medium
98079	CVS/SVN user disclosure	Medium
98078	E-mail address disclosure	Info
98077	Private IP address disclosure	Low
98074	Backup file	Medium
98073	Backup directory	Medium

Data Exposure Family for Web Application Scanning