Vulnerability Summary
Severity: CRITICAL
Type: Sensitive Data Exposure / Information Disclosure
CVSS Score: ~8.5
Description
The application defaults to debug: bool = True in backend/secuscan/config.py, which causes:
- Full Python tracebacks to be returned as HTML to HTTP clients on any unhandled exception
- Hot reload mode enabled via uvicorn, exposing file-system side-channel risks
- API documentation always accessible at
/docs and /openapi.json, providing attackers a complete endpoint map
Vulnerable Code
File: backend/secuscan/config.py:22
debug: bool = True # defaults to True
File: backend/secuscan/main.py:277-284
@app.exception_handler(Exception)
async def custom_unhandled_exception_handler(request: Request, exc: Exception):
logger.exception("Unhandled exception in request lifecycle")
if settings.debug:
import traceback
html = f"<html><body><h1>500 Internal Server Error</h1><pre>{traceback.format_exc()}</pre></body></html>"
response = HTMLResponse(html, status_code=500)
else:
response = PlainTextResponse("Internal Server Error", status_code=500)File: backend/secuscan/main.py:355
uvicorn.run(
"backend.secuscan.main:app",
host=settings.bind_address,
port=settings.bind_port,
reload=settings.debug, # hot reload when debug=True
log_level=settings.log_level.lower()
)File: .env.example:5
SECUSCAN_DEBUG=true # encourages production use of debug mode
Impact
- Information Disclosure: Full tracebacks expose internal file paths, database schema, library versions, and environment variable names to attackers.
- Attack Surface Expansion: OpenAPI docs at
/docs give attackers a complete map of every endpoint, parameter, and data model.
- Stability Risk: Uvicorn reload mode watches all source files, which can be abused for file-system side-channel timing attacks.
- Production Exposure: The
.env.example encourages setting DEBUG=true, meaning most deployments will run in debug mode.
Suggested Fix
- Change default to
False:
debug: bool = False # must be explicitly enabled
- Conditionally disable docs in production:
app = FastAPI(
...,
docs_url="/docs" if settings.debug else None,
redoc_url="/redoc" if settings.debug else None,
openapi_url="/openapi.json" if settings.debug else None,
)
- Update
.env.example:
Vulnerability Summary
Severity: CRITICAL
Type: Sensitive Data Exposure / Information Disclosure
CVSS Score: ~8.5
Description
The application defaults to
debug: bool = Trueinbackend/secuscan/config.py, which causes:/docsand/openapi.json, providing attackers a complete endpoint mapVulnerable Code
File:
backend/secuscan/config.py:22File:
backend/secuscan/main.py:277-284File:
backend/secuscan/main.py:355File:
.env.example:5Impact
/docsgive attackers a complete map of every endpoint, parameter, and data model..env.exampleencourages settingDEBUG=true, meaning most deployments will run in debug mode.Suggested Fix
False:.env.example: