In some applications, the HTTP methods GET and POST can be used interchangeably.
For example, the application may expect a POST request, and the frontend will also send the data in a POST request, but if the request is tampered with, the data will also be accepted in a GET request.
An example for this behavior would be Javas
getParameter or PHPs
$_REQUEST, which both deliver GET as well as POST parameters.
- Is this generally considered a security issue? Is it documented somewhere, for example as a CWE or by OWASP?
- Does this issue have a name?
- What are the dangers of POST to GET downgrade? One example I could think of would be the possibility to exploit CSRF issues via
imgtags, which means an attacker can place CSRF payloads on websites where they cannot post scripts, making it considerably easier to exploit the issue. Are there other benefits for attackers?
- What - if any - are the dangers of GET to POST change?