Title

The application must not store sensitive information in hidden fields. (Cat I impact)

Discussion

Hidden fields allow developers to process application data without having to display it on the screen. Using hidden fields to pass data in forms is a common practice among web applications and by itself is not a security risk. However, hidden fields are not secure and can be easily manipulated by users. Information requiring confidentiality or integrity protections must not be placed in a hidden field. If data that is sensitive must be stored in a hidden field, it must be encrypted. Furthermore, hidden fields used to control access decisions can lead to a complete compromise of access control mechanisms allowing immediate compromise of the user's application session.

Check Content

Interview application administrator and review application documentation to identify and familiarize with the application features and functions. Request most recent code review and vulnerability scan results. Review test configuration to ensure testing for hidden fields was conducted. Review test results for incidents of hidden data fields. Examine identified hidden fields and determine what type of data is stored in the hidden fields. If the data stored in the hidden fields are determined to be authentication or session related data, or if the code review or vulnerability scan results are not available and configured to test for hidden fields, this is a finding.

Fix Text

Design and configure the application to not store sensitive information in hidden fields. Encrypt sensitive information stored in hidden fields using DoD-approved encryption and use server side session management techniques for user session management.

Additional Identifiers

Rule ID: SV-222601r879812_rule

Vulnerability ID: V-222601

Group Title: SRG-APP-000441

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.