Sensitive data placed in a URL query string
ID |
vbnet.information_leak.sensitive_data_in_query_string |
Severity |
low |
Remediation Complexity |
medium |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Information Leak |
Language |
VB.NET |
Description
A sensitive value (password, token, secret or API key) is placed into a URL query string. Query strings leak through browser history, proxy and server access logs and the Referer header even when the request travels over HTTPS. Pass secrets in a request body or an HTTP header (for example Authorization) instead of the query string, and use POST rather than GET for sensitive data.
Rationale
A sensitive value (password, token, secret or API key) is placed into a URL query string. Query strings leak through browser history, proxy and server access logs and the Referer header even when the request travels over HTTPS. Pass secrets in a request body or an HTTP header (for example Authorization) instead of the query string, and use POST rather than GET for sensitive data.
The following code illustrates a vulnerable pattern detected by this rule:
Sub Bad(t As String, k As String, tok As String, s As String, p As String, key As String, client As HttpClient)
' VULNERABLE: Sensitive data placed in a URL query string
Response.Redirect("/login?token=" & t)
' VULNERABLE: Sensitive data placed in a URL query string
Dim u As New Uri("https://api.example.com/x?apikey=" & k)
' VULNERABLE: Sensitive data placed in a URL query string
client.GetAsync("https://api.example.com/data?access_token=" & tok)
' VULNERABLE: Sensitive data placed in a URL query string
client.GetStringAsync("https://api.example.com/data?secret=" & s)
' VULNERABLE: Sensitive data placed in a URL query string
link.NavigateUrl = "/reset?password=" & p
' VULNERABLE: Sensitive data placed in a URL query string
anchor.HRef = "/go?api_key=" & key
End Sub