Home / Vulnerability Database / C-sharp : Information leak: SignalR
C#
C-sharp : Information leak: SignalR
Classification
OWASP Top 10 2013
OWASP Top 10 2017
PCI DSS 4.0
CWE/SANS Top 25 2021
Overview
System configuration information leak is possible. This can help an attacker to plan an attack.
Automatically generated JavaScript proxy files can lead to information leakage on the system as they list all the exposed methods in the hubs.
If you do not want to include all hubs and methods in the JavaScript proxy file for each user, you can disable the automatic generation of the file. Disable automatic file generation if you have multiple hubs and methods, and you do not want every user to be aware of all of the methods.
References
- OWASP Top 10 2013-A5-Security Misconfiguration
- Introduction to SignalR Security
- OWASP Top 10 2017-A3-Sensitive Data Exposure
- OWASP Top 10 2017-A6-Security Misconfiguration
- CWE-497
- CWE CATEGORY: OWASP Top Ten 2017 Category A5 - Broken Access Control
- CWE CATEGORY: OWASP Top Ten 2017 Category A6 - Security Misconfiguration
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CWE-209: Generation of Error Message Containing Sensitive Information
LOW
DerScanner Severity Score
Do you want to fix C-sharp : Information leak: SignalR in your application?
See also
C#
C-sharp : JWT: None Algorithm
C#
C-sharp : Insecure data transmission: Database
C#