Use of GET Request Method With Sensitive Query Strings

Description

This vulnerability occurs when a web application handles sensitive data, like passwords or session tokens, by passing them within the URL's query string using an HTTP GET request.

Extended Description

Using GET requests for sensitive information is risky because the full URL, including the query string, is logged in browser histories, web server logs, and often in the referrer headers sent to third-party sites. This exposes credentials, tokens, or personal data to anyone with access to those logs, making it a common source of data leaks. Attackers can also trick users into clicking malicious links containing pre-filled sensitive parameters. To fix this, always use POST requests (or other appropriate HTTP methods) with the sensitive data placed in the request body, and ensure proper HTTPS encryption is enforced. While SAST and DAST tools can detect this pattern, managing remediation across a large codebase is challenging. An ASPM platform like Plexicus can automatically identify these flaws in your entire application portfolio and use AI to generate specific remediation guidance, streamlining the fix process.

Common Consequences 1

Scope: Confidentiality

Impact: Read Application Data

At a minimum, attackers can garner information from query strings that can be utilized in escalating their method of attack, such as information about the internal workings of the application or database column names. Successful exploitation of query string parameter vulnerabilities could lead to an attacker impersonating a legitimate user, obtaining proprietary data, or simply executing actions not intended by the application developers.

Detection Methods 1

Automated Static AnalysisHigh

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Potential Mitigations 1

Phase: Implementation

When sensitive information is sent, use the POST method (e.g. registration form).

Observed Examples 1

CVE-2022-23546A discussion platform leaks private information in GET requests.

Modes of Introduction

Architecture and Design

Implementation

Related Weaknesses

ChildOf:

Insertion of Sensitive Information Into Sent Data (CWE-201)

Taxonomy Mapping

Software Fault Patterns

Notes

OtherThe query string for the URL could be saved in the browser's history, passed through Referers to other web sites, stored in web logs, or otherwise recorded in other sources. If the query string contains sensitive information such as session identifiers, then attackers can use this information to launch further attacks.