PTKDMobile App Security
Knowledge base / PTKD-API-VERBOSE-ERROR
medium M8 MASVS-CODE-2 dynamic analysis PTKD-API-VERBOSE-ERROR

Server error leaks a stack trace

A server response body contained a stack trace or framework error, exposing internal paths, library versions, and query structure that help an attacker.

How it's exploited

A server response returned a raw stack trace or framework error. An attacker reads internal file paths, library versions, and query structure from it, then tailors an exploit (for example, confirming a SQL error to build an injection).

Why it matters

Information disclosure that accelerates targeted attacks and reveals your stack to anyone who can trigger an error.

How to fix it

  1. Return generic error messages to clients; log the details server-side only.
  2. Disable debug/verbose error pages in production configuration.

References