Umbraco CMS vulnerable to Generation of Error Message Containing Sensitive Information

@@ -33,6 +33,7 @@ internal static IApplicationBuilder UseProblemDetailsExceptionHandling(this IApp
             {
                 innerBuilder.UseExceptionHandler(exceptionBuilder => exceptionBuilder.Run(async context =>
                 {
+                    var isDebug = context.RequestServices.GetRequiredService<IHostingEnvironment>().IsDebugMode;
                     Exception? exception = context.Features.Get<IExceptionHandlerPathFeature>()?.Error;
                     if (exception is null)
                     {
@@ -42,16 +43,16 @@ internal static IApplicationBuilder UseProblemDetailsExceptionHandling(this IApp
                     var response = new ProblemDetails
                     {
                         Title = exception.Message,
-                        Detail = exception.StackTrace,
+                        Detail = isDebug ? exception.StackTrace : null,
                         Status = StatusCodes.Status500InternalServerError,
-                        Instance = exception.GetType().Name,
+                        Instance = isDebug ? exception.GetType().Name : null,
                         Type = "Error"
                     };
                     await context.Response.WriteAsJsonAsync(response);
                 }));
             });
 
-    internal static IApplicationBuilder UseEndpoints(this IApplicationBuilder applicationBuilder)
+internal static IApplicationBuilder UseEndpoints(this IApplicationBuilder applicationBuilder)
     {
         IServiceProvider provider = applicationBuilder.ApplicationServices;
 

@@ -43,14 +43,14 @@ public AspNetCoreHostingEnvironment(
         _webHostEnvironment = webHostEnvironment ?? throw new ArgumentNullException(nameof(webHostEnvironment));
         _urlProviderMode = _webRoutingSettings.CurrentValue.UrlProviderMode;
 
-        SetSiteName(hostingSettings.CurrentValue.SiteName);
+        SetSiteNameAndDebugMode(hostingSettings.CurrentValue);
 
         // We have to ensure that the OptionsMonitor is an actual options monitor since we have a hack
         // where we initially use an OptionsMonitorAdapter, which doesn't implement OnChange.
         // See summery of OptionsMonitorAdapter for more information.
         if (hostingSettings is OptionsMonitor<HostingSettings>)
         {
-            hostingSettings.OnChange(settings => SetSiteName(settings.SiteName));
+            hostingSettings.OnChange(settings => SetSiteNameAndDebugMode(settings));
         }
 
         ApplicationPhysicalPath = webHostEnvironment.ContentRootPath;
@@ -95,7 +95,7 @@ public string ApplicationId
         _hostingSettings.CurrentValue.ApplicationVirtualPath?.EnsureStartsWith('/') ?? "/";
 
     /// <inheritdoc />
-    public bool IsDebugMode => _hostingSettings.CurrentValue.Debug;
+    public bool IsDebugMode { get; private set; }
 
     public string LocalTempPath
     {
@@ -188,8 +188,12 @@ public void EnsureApplicationMainUrl(Uri? currentApplicationUrl)
         }
     }
 
-    private void SetSiteName(string? siteName) =>
-        SiteName = string.IsNullOrWhiteSpace(siteName)
+    private void SetSiteNameAndDebugMode(HostingSettings hostingSettings)
+    {
+        SiteName = string.IsNullOrWhiteSpace(hostingSettings.SiteName)
             ? _webHostEnvironment.ApplicationName
-            : siteName;
+            : hostingSettings.SiteName;
+
+        IsDebugMode = hostingSettings.Debug;
+    }
 }