Development tools and frameworks usually have options to make debugging easier for developers, but these features should never be enabled for applications deployed in production.

Why is this an issue?

Debug instructions or error messages can leak detailed information about the system, such as the application’s path, file names, or stack traces. The rule flags configurations and API calls that enable debug features, including stack trace printing, verbose logging, debug mode flags, and remote debugging endpoints.

Activating a development feature in a mobile application can have an important range of consequences depending on its use:

In all cases, the attack surface of an affected application is increased. In some cases, such features can also make the exploitation of other unrelated vulnerabilities easier.

What is the potential impact?

Information disclosure

Attackers can exploit debug output to learn internal application details, file paths, stack traces, and configuration data that can be leveraged to craft further attacks.

Increased attack surface

Debug features may expose remote debugging endpoints, profiling APIs, or detailed error pages that significantly increase the attack surface of the application.

How to fix it in Android

Code examples

Debug features should be disabled or guarded by environment checks before deploying to production.

In AndroidManifest.xml the android debuggable property is set to true. The application will therefore be debuggable.

Noncompliant code example

<application
  android:icon="@mipmap/ic_launcher"
  android:label="@string/app_name"
  android:roundIcon="@mipmap/ic_launcher_round"
  android:supportsRtl="true"
  android:debuggable="true"
  android:theme="@style/AppTheme">
</application>  <!-- Noncompliant -->

Compliant solution

In AndroidManifest.xml the android debuggable property is set to false:

<application
  android:icon="@mipmap/ic_launcher"
  android:label="@string/app_name"
  android:roundIcon="@mipmap/ic_launcher_round"
  android:supportsRtl="true"
  android:debuggable="false"
  android:theme="@style/AppTheme">
</application>

How to fix it in ASP.NET

Code examples

Debug features should be disabled or guarded by environment checks before deploying to production.

In a web.config file, the customErrors element’s mode attribute is set to Off. The application will disclose unnecessarily verbose information to its users upon error.

Noncompliant code example

<configuration>
  <system.web>
    <customErrors mode="Off" /> <!-- Noncompliant -->
  </system.web>
</configuration>

Compliant solution

In a web.config file, the customErrors element’s mode attribute is set to On:

<configuration>
  <system.web>
    <customErrors mode="On" />
  </system.web>
</configuration>

Resources

Documentation

Standards