Web Form Sending Credentials Using GET (PCI-DSS check)

medium Nessus Plugin ID 108807

Language:

Synopsis

Web application form sends credentials using HTTP GET request.

Description

The remote web application has a form that sends credentials using an HTTP GET request. This can cause sensitive information such as usernames and passwords to be logged by the server in access logs.

Authors of services which use the HTTP protocol SHOULD NOT use GET based forms for the submission of sensitive data, because this will cause this data to be encoded in the Request-URI. Many existing servers, proxies, and user agents will log the request URI in some place where it might be visible to third parties.

This plugin only runs when 'Check for PCI-DSS compliance' is enabled in the scan policy.

Solution

Change web application forms to use HTTP POST instead.

Plugin Details

Severity: Medium

ID: 108807

File Name: web_forms_sending_creds_using_get.nasl

Version: 1.2

Type: remote

Family: Web Servers

Published: 4/3/2018

Updated: 3/4/2019

Supported Sensors: Nessus

Risk Information

CVSS Score Rationale: Score based on analysis of effect of the configuration error.

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: manual

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Vulnerability Information

Required KB Items: Settings/PCI_DSS

Detections

Analytics