ASP.NET allows remote debugging of web applications, if configured to do so. By default, debugging is subject to access control and requires platform-level authentication. If an attacker can successfully start a remote debugging session, this is likely to disclose sensitive information about the web application and supporting infrastructure that may be valuable in formulating targeted attacks against the system.
To disable debugging, open the Web.config file for the application, and find the element within the section. Set the debug attribute to "false". Note that it is also possible to enable debugging for all applications within the Machine.config file. You should confirm that the debug attribute in the element has not been set to "true" within the Machine.config file.
Get AI-powered remediation steps tailored to your asset.
Try AI Solutions →