Title

Firefox must be configured to disable form fill assistance. (Cat II impact)

Discussion

To protect privacy and sensitive data, Firefox provides the ability to configure the program so that data entered into forms is not saved. This mitigates the risk of a website gleaning private information from prefilled information.

Check Content

Type "about:policies" in the browser window. If "DisableFormHistory" is not displayed under Policy Name or the Policy Value is not "true", this is a finding.

Fix Text

Windows group policy: 1. Open the group policy editor tool with "gpedit.msc". 2. Navigate to Policy Path: Computer Configuration\Administrative Templates\Mozilla\Firefox Policy Name: Disable Form History Policy State: Enabled macOS "plist" file: Add the following: <key>DisableFormHistory</key> <true/> Linux "policies.json" file: Add the following in the policies section: "DisableFormHistory": true

Additional Identifiers

Rule ID: SV-251551r879587_rule

Vulnerability ID: V-251551

Group Title: SRG-APP-000141

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.