Stack Trace Disclosure (Laravel)

Description

The application exposes detailed Laravel framework stack traces to users when errors occur. These stack traces reveal internal application structure, including file paths, code snippets, framework versions, database details, and configuration information. Stack trace disclosure typically occurs when Laravel's debug mode is enabled in production environments or when exception handling is improperly configured.

Remediation

Disable debug mode in production environments by setting APP_DEBUG=false in your .env file. Configure custom error pages to display user-friendly messages without technical details. Implement proper exception handling throughout your application:

// In app/Exceptions/Handler.php
public function render($request, Throwable $exception)
{
    if ($this->shouldReport($exception)) {
        // Log the full exception details
        Log::error($exception);
    }
    
    // Return generic error response
    if (!config('app.debug')) {
        return response()->view('errors.500', [], 500);
    }
    
    return parent::render($request, $exception);
}

References

Related Vulnerabilities