Unintended Information Leakage
V13.4.1
Verify that the application is deployed either without any source control metadata, including the .git or .svn folders, or in a way that these folders are inaccessible both externally and to the application itself.
Required for Level 1, 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 11, 116, 121, 133, 149, 150, 155, 169, 176, 188, 207, 310, 37, 497, 54
V13.4.2
Verify that debug modes are disabled for all components in production environments to prevent exposure of debugging features and information leakage.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 116, 121, 133, 150, 169, 184, 188, 207, 215, 224, 310, 444, 523, 54, 541
V13.4.3
Verify that web servers do not expose directory listings to clients unless explicitly intended.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 116, 127, 149, 150, 155, 169, 497, 54
V13.4.4
Verify that using the HTTP TRACE method is not supported in production environments, to avoid potential information leakage.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 116, 133, 150, 169, 224, 54, 541
V13.4.5
Verify that documentation (such as for internal APIs) and monitoring endpoints are not exposed unless explicitly intended.
Required for Level 2 and 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 116, 121, 133, 150, 169, 188, 224, 233, 240, 36, 54, 541, 69, 87
V13.4.6
Verify that the application does not expose detailed version information of backend components.
Required for Level 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 116, 133, 150, 169, 188, 215, 224, 310, 54, 541
V13.4.7
Verify that the web tier is configured to only serve files with specific file extensions to prevent unintentional information, configuration, and source code leakage.
Required for Level 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 11, 116, 133, 149, 150, 155, 169, 176, 188, 191, 224, 310, 37, 497, 54, 541
Disclaimer
Credit via OWASP ASVS.For more information visit: The OWASP ASVS Project or Github respository.. OWASP ASVS is under the Creative Commons Attribution-Share Alike v4.0 license.
