VNX-215: Insertion of Sensitive Information Into Debugging Code

Detects debugging facilities left switched on for every visitor: Python cgitb.enable(), a Django Debug Toolbar shown to everyone, Express errorhandler outside a development check, the Node.js inspector bound to 0.0.0.0, and ASP.NET Core UseDeveloperExceptionPage/UseDatabaseErrorPage outside IsDevelopment().

Field	Value
Rule ID	`VNX-215`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	JavaScript / TypeScript, Python, C#, Dockerfile, Shell
CWE	CWE-215
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`debug` `information-exposure` `cwe-215`
Source	`internal/sast/rules/vnx-215.rego`

Overview

VNX-215 maps to CWE-215: Insertion of Sensitive Information Into Debugging Code. Debugging facilities exist to show internal state: stack frames with their local variables, source code, request headers and bodies, SQL statements, settings and process memory. Enabled in production, they hand all of it to whoever triggers an error or reaches the debug port.

Platform	Reported
Python	`cgitb.enable()` (also through `import cgitb as x`) unless `display=0`; Django Debug Toolbar `SHOW_TOOLBAR_CALLBACK` set to `lambda request: True`
Node.js	`app.use(errorhandler())` with the `errorhandler` package, outside a `NODE_ENV` / `app.get('env')` / development check; `--inspect=0.0.0.0` / `--inspect-brk=0.0.0.0` in a Dockerfile, package.json, compose file or shell script; `inspector.open(port, '0.0.0.0')`
ASP.NET Core	`UseDeveloperExceptionPage()` and `UseDatabaseErrorPage()` outside `IsDevelopment()`, `IsEnvironment()` or `#if DEBUG`

A guard counts on the same line or on a condition line up to eight lines above at a shallower indent.

What Gets Flagged

app.use(errorhandler());   // FLAGGED

CMD ["node", "--inspect=0.0.0.0:9229", "server.js"]   # FLAGGED

cgitb.enable()   # FLAGGED

app.UseDeveloperExceptionPage();   // FLAGGED (no IsDevelopment() check)

What Is Not Flagged

The same calls inside if (process.env.NODE_ENV === 'development'), if (app.Environment.IsDevelopment()), if (!app.Environment.IsProduction()) or, for cgitb, if os.environ.get("APP_DEBUG"):.
cgitb.enable(display=0, logdir=...), a toolbar callback that checks DEBUG or INTERNAL_IPS, --inspect with no host or bound to 127.0.0.1.
A project’s own error-handling middleware, comments, strings and test code.
Django DEBUG = True (VNX-PY-006), the Flask/Werkzeug debugger (VNX-PY-008) and Go pprof endpoints (VNX-GO-019), which have their own rules.

Remediation

if (process.env.NODE_ENV === 'development') {
  app.use(errorhandler());
}

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-215
// nosec vnx-215

Or record an ignore rule: vulnetix ignore add --rule vnx-215 --reason "...". See Suppressing findings.