ELMAH (Error Logging Modules and Handlers) is an application-wide error logging facility that is completely pluggable. It can be dynamically added to a running ASP.NET web application, or even all ASP.NET web applications on a machine, without any need for re-compilation or re-deployment. If ELMAH is not properly configured, the elmah.axd handler can be accessed without authorization. This page will list all the error messages generated by the web application and may disclose sensitive information to an attacker such as:

- Session cookies
- Session state
- Query string and post variables
- Physical path of the requested file

Apply the following changes in your web.config file to disable remote access to the Elmah.axd:

<elmah>
	 <security allowRemoteAccess="no"/> 
</elmah>

You can also adjust web.config to deny access to this entity without proper authorization.

<location path="elmah.axd">
  <system.web>
	<authorization>
	  <allow roles="Admin">
	  <deny users="*">
	</deny></allow></authorization>
  </system.web>
</location>