108

A couple of days ago, I attempted to log into the website of a well-known SaaS provider. I used a password manager on my browser (so user/pass were correct) and the NoScript plugin which had limited permissions granted to the site so some JS was blocked. The whole exchange was over HTTPS.

The response was a redirect back to the login site with a URL as below, and the login_password data had also been populated to the value of the password input.

.../login?login_email=user@example.com&login_password=REDACTED&remember_me=on

Would this be classed as just a weak approach and a bad practice to be raised with customer support, or should this be reported as a security vulnerability?

Update

The company has responded with a stop-gap fix that prevents the original issue from being reproduced.

  • 92
    Name and shame please. – superluminary Jul 5 '18 at 15:46
  • 120
    "REDACTED" is a really bad password. You should know not to use dictionary words. ;-) – David Richerby Jul 5 '18 at 17:35
  • 24
    Regardless how it is shown, passwords in plaintext are always problematic... – Willem Van Onsem Jul 5 '18 at 19:40
  • 11
    Googling the remember_me parameter brings up a lot of results for Symfony, so the SaaS provider's website is probably using that software. @markdwhite Just curious, is this Dropbox? – mbomb007 Jul 5 '18 at 21:23
  • 21
    Just seeing the words "password" and "plain text" in the same sentence should make anyone automatically cringe, regardless what that sentence is about. – vsz Jul 6 '18 at 8:11
128

Definitely problematic - and worth reporting.

If the HTTPS is properly protected with HSTS and preloading, then threat actors observing the traffic wouldn't be able to see the GET contents. But since HSTS is still somewhat rare (and if they're putting plaintext passwords in a GET, they're probably not aware of other best practices like HSTS), the interception/downgrade risk is probably somewhat high.

Separate from that, regardless of the health of the HTTPS setup, remote HTTP servers almost always log full GET contents in the server's logs - so those plaintext passwords are probably being recorded on the server as well.

[Edit: and vakus' answer covers the rest of the attack vectors much more thoroughly!]

  • 67
    Not only worth reporting... It's downright classified as an explicit vulnerability in OWASP. – forest Jul 5 '18 at 6:53
  • 51
    I believe you should also mention that GET parameters will be stored as part of web browser history. This means that if an attacker gets physical access to your computer they can hijack your account, or if you are using a public computer you may potentially expose your password to next users. – vakus Jul 5 '18 at 7:16
  • 4
    @vakus - I'm not sure if it entirely applies, but GET parameters can appear in HTTP referrer headers as well. Any off-site resources loaded from the page may also be shipped your credentials via referrer header. – Mr. Llama Jul 5 '18 at 17:43
  • 10
    @Mr.Llama owasp.org/index.php/Password_Storage_Cheat_Sheet - Common vulnerabilities allow the theft of protected passwords through attack vectors such as SQL Injection. Protected passwords can also be stolen from artifacts such as logs, dumps, and backups. – March Ho Jul 5 '18 at 18:06
  • 1
    Also note local browser history may make a copy of it. – Yakk Jul 5 '18 at 18:45
121

This should be reported right away.

There is a multitude of possible attacks which could result in compromise of user accounts.

The password shown as a GET parameter is not only a vulnerability according to OWASP, there are many ways those could be abused.

Common vulnerabilities allow the theft of protected passwords through attack vectors such as SQL Injection. Protected passwords can also be stolen from artifacts such as logs, dumps, and backups.

(Quote and link from March Ho's comment)

I would go even as far into considering finding another service, as such policy shows a lack of competence.

Here are some highlights that can be included in the report

Log file

The password submitted by GET parameter will be logged into a log file. This means that an administrator of the service is now able to view your passwords in plain text. This is as bad as storing passwords in plain text in the database. There is nothing which assures users that the administrator or privileged person won't turn rogue and use users' passwords to access their other services. And as we all know password reuse is more than common.

This also means that if the system is compromised the attacker only needs to read the log files rather than crack the database. This is a huge vulnerability and would result in many user accounts being compromised across many platforms.

A similar thing happened to twitter recently, where passwords were stored as plain text in one of the internal log files. Twitter have prompted all users to change their passwords, including on other websites where the users used the same password, even through there was no evidence of compromise or abuse of this bug. This shows that this may have serious impact on the users if the server would get compromised.

Shoulder eye picking

Anyone who is nearby would be able to see your password in plain text and could note it down. That password could then be used to compromise other services, because passwords are often reused across services.

Browser history

The passwords would be stored as a part of web browser history, meaning anyone with access to your computer and web browser will be able to log into your account without knowledge of password. This only gets worse if you are using a public computer.

As a result of this anyone with access to the history can now also copy your password and login, again allowing to compromise your other services.

HTTPS

You said that the website operates with use of HTTPS. There is however no guarantee that the website is using preloading and HSTS.

HSTS will force a web browser to load the website over an HTTPS connection.

If the website is not using HSTS, then the website may fail to be upgraded to HTTPS connection. This can be done via SSL Strip, which will turn all HTTPS links to HTTP. If the website is using HSTS, the web browser will automatically try to load the website over HTTPS, and if not able to will refuse to connect by HTTP. However even if the website uses HSTS, if the website was never opened before on the target web browser, SSL Strip attack would till work, as the web browser would not yet know that this website should only be loaded over HTTPS.

To prevent this an website would use preloading. For preloading, the web browser would have a built-in database of websites which must be loaded via HTTPS and should never be loaded by HTTP. This effectively would prevent an HTTPS downgrade attack.

Security audits

The fact that the passwords are stored as part of the log file shows that the company is most likely not performing security audits, or if they are, that they are not very heavily focused on security as a company.

HTTP Referer

As mentioned in comments by Mr Llama

GET parameters can appear in HTTP referrer headers as well. Any off-site resources loaded from the page may also be shipped your credentials via referrer header.

Link Sharing

If for some reason you need to give a link to the website to someone else e.g. coworker, you are more than likely just to copy it and send it to that person. This would again give this person access to your account and your login and password information, which can be used to access accounts on other platforms.

Search Spiders

Search spiders are basically following each possible link on a website and indexing it. While this is less probable, a search spider like Google or Bing could index an exposed link and show it as part of website search. This would mean that people could log into your account from Google or Bing.


I would go as far into reaching out to the company as urgently as possible. The security impact of this is huge and will affect many users.

I would even consider changing the SaaS provider if possible, and if the company would not comply to the report, they should be publicly shamed for plain password offending.

  • 4
    A report has been made using the HackerOne service using some of the comments provided in your and Royce's answers. For now I'm bound by the confidentiality conditions of the bounty program, but will update here as and when I can. Thanks. – markdwhite Jul 5 '18 at 9:17
  • 3
    @vakus: is there a typo in "However HTTPS can be downgraded to HTTPS"? It doesn't make any sense to me. – Nigel Touch Jul 5 '18 at 10:10
  • 1
    @NigelTouch You are right, i haven't noticed that, as I wrote the entire answer on my phone – vakus Jul 5 '18 at 10:11
  • 12
    Your English is fine. Typos like those mentioned are common even among native speakers. Excellent answer! +1 – jpmc26 Jul 6 '18 at 0:41
  • 6
    @vakus Your answer reads better than most native English speakers I encounter. – Nonny Moose Jul 7 '18 at 20:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.