7.2 Disable Development Tools

Information

This setting configures whether or not development tools are available to the user. Firefox Developer Tools is a set of web developer tools built into Firefox that can be used to examine, edit, and debug HTML, CSS, and JavaScript.

Rationale:

Information needed by an attacker to begin looking for possible vulnerabilities in a web browser includes information about the web browser and plug-ins or modules being used. When debugging or trace information is enabled in a production web browser, information about the web browser, such as web browser type, version, patches installed, plug-ins and modules installed, type of code being used by the hosted application, and any back ends being used for data storage may be displayed. Because this information may be placed in logs and general messages during normal operation of the web browser, an attacker does not have to cause an error condition to gain this information.

Impact:

Users with creative roles that require development tools will need additional permissions granted based on their role.

Solution

To establish the recommended configuration, set devtools.application.enabled to false:

Type about:config in the address bar

Type devtools.application.enabled in the filter

Ensure the setting is set as prescribed.

OR

Open the mozilla.cfg file in the installation directory with a text editor

Add the following lines to mozilla.cfg:

lockPref('devtools.application.enabled', false);

See Also

https://workbench.cisecurity.org/files/4299

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7a.

Plugin: Unix

Control ID: 16f09bf071abc806ccf37fcc1ffa4bbaa5c4492cd0b71706ceb19b01dc3dadc4