ELMAH Information Leak

Reference

Plugin Id: 40028 | CWE: 94

Remediation

To remediate the ELMAH Information Leak vulnerability, follow these steps:

Disable ELMAH HTTP Module: If ELMAH is not required for your application, disable the ELMAH HTTP Module by removing or commenting out the relevant configuration in the web.config file. For example, if using ASP.NET, remove the following lines:
```
<httpModules>
  <add name="ErrorLog" type="Elmah.ErrorLogModule, Elmah" />
</httpModules>
```
Restrict Access to elmah.axd: If ELMAH is needed for your application, restrict access to the elmah.axd URL to authorized users only. This can be done by adding appropriate authorization rules in the web.config file. For example, to allow access only to users in the “Admin” role:
```
<location path="elmah.axd">
  <system.web>
    <authorization>
      <allow roles="Admin" />
      <deny users="*" />
    </authorization>
  </system.web>
</location>
```
Regularly Monitor and Review Logs: Regularly monitor and review the logs generated by ELMAH to identify any potential information leaks. Ensure that sensitive information is not being logged or exposed.

About

The Error Logging Modules and Handlers (ELMAH [elmah.axd]) HTTP Module is a component that allows for logging and handling of errors in web applications. It provides valuable information for debugging and troubleshooting purposes. However, if not properly secured, it can also leak a significant amount of valuable information.

Risks

The ELMAH Information Leak vulnerability poses the following risks:

Exposure of Sensitive Information: If an attacker gains access to the ELMAH HTTP Module, they can potentially extract sensitive information from the logs, such as usernames, passwords, or other confidential data.
Increased Attack Surface: The availability of the ELMAH HTTP Module provides an additional entry point for attackers to exploit vulnerabilities in the application.
Potential for Information Disclosure: Information leaked through the ELMAH HTTP Module can be used by attackers to gain insights into the application’s architecture, potential vulnerabilities, or other sensitive details that can aid in further attacks.