GSA / GSA/ai-experience-sharing-platform
Finding: Information Leakage
Open
pentest
- Dominant language
- JavaScript
- Stars
- 12
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Description
> The Error Logging Modules and Handlers (ELMAH [elmah.axd]) HTTP Module was found to be available. This module can leak a significant amount of valuable information.
Similar to #338, this finding is due to this application being a SPA, which returns 200 on all URLs. As a result, no logging data is exposed at the URL identified by the pentest.
Contributor guide
Research direction
Start by reviewing the SPA routing behavior and the elmah.axd URL mentioned in the finding. Verify whether the URL exposes any logging data in the deployed application; done means confirming the finding is not reproducible or identifying the specific routing or configuration change required.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- security, web-dev
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100