Skip to Content (Press Enter)
How is your experience with the OutSystems Community?
UserImage.jpg
Apoorva Helavar
37Views
2Comments
Improper Error Handling in OutSystems Applications
Question
Traditional Web
Application Type
Traditional Web

Vulnerable :  URL https://smartapps.iifl.com/*PaymentsCollectionUI/IIFLQuickPay.aspx?_ ts=1752214960934
 Vulnerable Parameter : URL
Description : It was observed that by requesting a specially crafted URL is possible to generate an error message. The message may contain detailed internal error messages such as stack traces, database dumps, application path and error codes are displayed to the user. Such details can provide potential flaws in the site and such messages are also disturbing to normal users. 
Impact: This information might help an attacker gain more information and potentially focus on the development of further attacks for the target system. 
Recommendations : Apply the following changes to your web.config file to prevent information leakage by using custom error pages. 

we have Tried with recommendations but its not working 


vapt3.png
0
0
22 May
Copy Link
2024-01-31 05-29-41
Akshay Deshpande

Hello @Apoorva Helavar , 


If customErrors changes are not working, check these additional points:

  • Enable both:
    • <customErrors mode="On" />
    • <httpErrors errorMode="Custom" existingResponse="Replace" />
  • In OutSystems, also verify:
    • Factory Configuration → Log/Error settings
    • Environment is not running in Debug mode
    • Detailed ASP.NET errors are disabled at IIS level
  • For Traditional Web apps, some exceptions bypass customErrors and are handled by the platform pipeline, especially malformed ASPX requests.
  • If hosted in OutSystems Cloud, raise a support ticket because infrastructure-level IIS settings may be managed by OutSystems.

Do it as practice:
Return a generic error page and log details only in Service Center / Lifetime, never to the browser response.

Thanks and Regards,
Akshay Deshpande

0
0
27 May
Copy Link
2019-01-07 16-04-16
Siya
 
MVP

@Apoorva Helavar : Please have a look at https://success.outsystems.com/documentation/11/building_apps/handling_exceptions/customizing_outsystems_platform_pages_for_unhandled_errors/ on how to customise the error pages. However these instructions are for on premise. In your scenario is OutSystems Cloud do reach out to OutSystems support on how they can help resolve this.

0
0
28 May
Copy Link
Community GuidelinesBe kind and respectful, give credit to the original source of content, and search for duplicates before posting.