Use of HTTP Request With Sensitive Query String

Opis

The web application uses an HTTP method to process a request, but the request includes sensitive information in the query string.

Skutki

• Confidentiality

  Read Application Data

  At a minimum, attackers can garner information from query strings that can be utilized in escalating their method of attack, such as information about the internal workings of the application or database column names. Successful exploitation of query string parameter vulnerabilities could lead to an attacker impersonating a legitimate user, obtaining proprietary data, or simply executing actions not intended by the application developers.

  Examples of sensitive information may include secrets such as session identifiers, passwords, access tokens, or API keys; Personally Identifiable Information (PII) such as email addresses or phone numbers; records or logs of private activities; communications that are expected to be private; etc. Successful exploitation of query string parameter vulnerabilities could lead to an attacker impersonating a legitimate user, obtaining proprietary data, or simply executing actions not intended by the application developers.

Zapobieganie

• Implementation

  When sending sensitive information, only include it in the request body or request headers instead of the query string. This may require avoiding use of GET requests.

Przykłady podatności

• CVE-2025-1738 Security camera includes a password in its query string
• CVE-2025-31954 ML/NLP-based automation product calls a GET method with sensitive information in the query string.
• CVE-2024-31842 Web-based communication product includes an access token in the query string of a GET request
• CVE-2022-23546 A discussion platform leaks private information in GET requests.

Słabość nadrzędna

• CWE-201 Insertion of Sensitive Information Into Sent Data

Kiedy powstaje

• Architecture and Design
• Implementation

Dotyczy

Not Language-Specific, Web Based, Web Server

Źródła

1. Information exposure through query strings in URL — OWASP, 2020