Enviar #678649: PHPGurukul News Portal using Python Django and MySQL 1.0 Insertion of Sensitive Information Into Debugging Code

The Django application has DEBUG mode enabled in a production settings file — a serious misconfiguration that fundamentally undermines operational security because Django’s DEBUG mode is intended strictly for development. When DEBUG is True, Django returns verbose error pages containing full Python stack traces, source-file references, local variable contents, template fragments, installed-app and middleware lists, request metadata, and other internals that are normally hidden. An attacker who triggers an exception can harvest this information to map the application’s structure, discover absolute file paths, identify framework and library versions, locate configuration files, infer database backends and connection patterns, and observe values that may include secret tokens, API keys, or environment-derived settings. That reconnaissance reduces attacker effort dramatically — what would otherwise require time-consuming probing becomes a guided roadmap to privilege escalation, SQL injection targeting, path traversal, or locating sensitive endpoints. In some deployment scenarios, the debug output also reveals environment variables, session data examples, or serialized payloads, any of which can materially increase the blast radius if secrets are present elsewhere in the codebase or CI/CD pipeline. Beyond information leakage, leaving DEBUG enabled is a procedural failure indicating weak deployment hygiene: it often correlates with missing production safeguards such as strict ALLOWED_HOSTS, proper error logging/monitoring, and hardened web server configuration. Exploitation requires only that an attacker provoke an error (often trivial via malformed input), so the vulnerability is low-effort and high-impact. Immediate remediation is straightforward and urgent: set DEBUG = False in production, ensure ALLOWED_HOSTS is correctly configured, deploy custom user-facing error pages, and route detailed errors to secure logging/monitoring only accessible by administrators. After fixing, perform a forensic review for any sensitive data exposed while DEBUG was active (rotate any leaked secrets, reset credentials, and audit access logs). Finally, add automated CI/ pre-commit checks to block commits containing DEBUG = True in production config and include this in deployment runbooks to prevent recurrence.

• Fuente: ⚠️ https://github.com/NishantKumar-CSE/News-Portal-Python-Django-Project/blob/main/Information%20Disclosure%20via%20Debug%20Mode.md
• Usuario: Nishant_Kumar (UID 91843)
• Sumisión: 2025-10-20 18:36 (hace 8 meses)
• Moderación: 2025-11-02 14:14 (13 days later)
• Estado: Aceptado
• Entrada de VulDB: 330910 [PHPGurukul News Portal 1.0 /onps/settings.py divulgación de información]
• Puntos: 20