Rule Definition
Attackers can leverage the additional information they gain from debugging output to mount attacks targeted on the framework or other resources used by the application. Setting IncludeExceptionDetailInFaults to true enables clients to obtain information about internal service method exceptions; it is only recommended as a way of temporarily debugging a service application. In addition, the WSDL for a method that returns unhandled managed exceptions in this way does not contain the contract for the FaultException of type ExceptionDetail. Clients must expect the possibility of an unknown SOAP fault to obtain the debugging information properly.

Remediation
Set the includeExceptionDetailInFaults to False

Violation Code Sample

Sample in the config file 

<configuration>  
<system.serviceModel>    
<behaviors><serviceBehaviors>        
<behavior name="MyServiceBehavior">          
<serviceDebug includeExceptionDetailInFaults="true" httpHelpPageEnabled="True"/>
..
..
</configuration>

_____________________________________________________

Sample in Source Code(Non-IIS Hosting Scenarios):
ServiceHost host = new ServiceHost(typeof(MyWCFService));

ServiceDebugBehavior debug = host.Description.Behaviors.Find<ServiceDebugBehavior>();

if (debug == null)
{
    host.Description.Behaviors.Add(
         new ServiceDebugBehavior() { IncludeExceptionDetailInFaults = true }); // Violation
}
else
{  
    if (!debug.IncludeExceptionDetailInFaults)
    {
        debug.IncludeExceptionDetailInFaults = true; //Violation
    }
}

host.Open();
....
[ServiceBehavior(ConcurrencyMode = ConcurrencyMode.Single,InstanceContextMode = InstanceContextMode.Single,IncludeExceptionDetailInFaults=true)]

Fixed Code Sample

Remediation in Config File:

<serviceDebug includeExceptionDetailInFaults="false" httpHelpPageEnabled="True"/> // Fixed

___________________________________________

Remediation in source Code:
ServiceHost host = new ServiceHost(typeof(MyWCFService));

ServiceDebugBehavior debug = host.Description.Behaviors.Find<ServiceDebugBehavior>();

// if not found - add behavior with setting turned on 
if (debug == null)
{
    host.Description.Behaviors.Add(
         new ServiceDebugBehavior() { IncludeExceptionDetailInFaults = false }); //Fixed
}
else
{  
    // make sure setting is turned ON
    if (!debug.IncludeExceptionDetailInFaults)
    {
        debug.IncludeExceptionDetailInFaults = false; //Fixed
    }
}

host.Open();
....
[ServiceBehavior(ConcurrencyMode = ConcurrencyMode.Single,InstanceContextMode = InstanceContextMode.Single,IncludeExceptionDetailInFaults=false)]

CWE-215 : http://cwe.mitre.org/data/definitions/215.html https://docs.microsoft.com/en-us/dotnet/api/system.servicemodel.servicebehaviorattribute.includeexceptiondetailinfaults?view=netframework-4.8