ASP.NET Application Trace Enabled

How it was found

Description: The ASP.NET application trace feature is enabled on the public-facing URL: ██████████. This exposes sensitive internal information, including Session ID values and the physical file paths of server-side resources. An attacker could leverage this data to gain unauthorized insights into the server environment or session management mechanisms, increasing the risk of further exploitation.

PoC: ██████

References

███████ ███

Impact

Information Disclosure: Reveals internal application structure and configuration. Session Hijacking Risk: Exposed Session ID values could potentially allow unauthorized access to active user sessions. Attack Surface Expansion: Exposed file paths and server-side request details can aid in reconnaissance for further exploitation attempts.

System Host(s)

██████████

Affected Product(s) and Version(s)

CVE Numbers

Steps to Reproduce

Open the link.

Suggested Mitigation/Remediation Actions

Remove this file from your website or change its permissions to remove access.

More information: https://www.acunetix.com/vulnerabilities/web/trace-axd-detected/