4

I've recently encountered a webapp, which has it's url in the following format:

http://www.[WEBAPP].com/INetService/Show.aspx?Username=[EMAIL]&EncryptedPassword=[Some String of 32 characters length]

Now this seems like a pretty bad way of delivering the login credentials to the server especially since not only is it using http, so an attacker could easily read the traffic, but also you can copy paste this link after any duration of time into another browser on another computer and it will work.

This effectively means that if the users browser history is somehow compromised (for example by carelessly using a public computer), the users account can be compromised aswell, and logging out is essentially doing nothing.

How should I proceed, should I notify the developer of the application?

  • What does the full HTTP request header look like? While not using HTTPS is concerning, there may be other request headers that mitigate vulnerabilities. – user2320464 Oct 21 '16 at 18:31
  • Have you verified that you can in fact use the same link on an other computer at a later time? It might include a nonce or something like that to prevent a replay attack. Still not a good system, but at least not that horrible. – Anders Oct 21 '16 at 18:33
  • Yeah, I verified it. It indeed works on other computers. – Bernd Schoolmann Oct 21 '16 at 18:47
6

Yes you should notify the developer. This could be regarded as quite a serious vulnerability. It's their choice whether or not they choose to listen to your advice, but at least you can rest easy knowing that you did what you could to help them improve their security for their web application.

At the end of the day they are the ones that are ultimately responsible for the security of their users, and they would be extremely foolish to ignore this obvious loophole in security.

If you choose to write an email/message to the developers, try to outline the possible consequences of inaction. This could help kickstart them into actually fixing the bug.

EDIT: I would propose they make the following changes...

  • Use the 'post' method when submitting web forms so that information is not displayed in the URL of the webpage like it is at the moment.
  • Suggest implementing SSL to add a basic level of encryption to the communication between the client and the server
  • Suggest using cookies to store session information and NEVER to use the information provided in a URL as a valid form of authentication. In theory when designing apps like this it would be wise to make the assumption that you CANNOT trust the end user and therefore the server side scripts/software must perform all of the necessary validation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.