Sitelet https://web.archive.org/web/20221004160606/https://github.com/github/securitylab/issues/223
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Java] CWE-598: Use of GET Request Method with Sensitive Query Strings #223

Closed
1 task done
luchua-bc opened this issue Dec 26, 2020 · 11 comments
Closed
1 task done

[Java] CWE-598: Use of GET Request Method with Sensitive Query Strings #223

luchua-bc opened this issue Dec 26, 2020 · 11 comments
Labels
All For One Submissions to the All for One, One for All bounty

Comments

@luchua-bc
Copy link

luchua-bc commented Dec 26, 2020 •
edited

CVE ID(s)

List the CVE ID(s) associated with this vulnerability. GitHub will automatically link CVE IDs to the GitHub Advisory Database.

Report

Describe the vulnerability. Provide any information you think will help GitHub assess the impact your query has on the open source community.

When an application uses the GET method to submit sensitive information such as passwords and access tokens, it is transmitted within the query string of the requested URL. Sensitive information within URLs may be logged in various locations, including the user's browser, the web server, and any forward or reverse proxy servers between the two endpoints. URLs may also be displayed on-screen, bookmarked or emailed around by users. They may be disclosed to third parties via the Referer header when any off-site links are followed. Placing passwords into the URL therefore increases the risk that they will be captured by an attacker.

This kind of vulnerabilities is categorized as CWE-598: Use of GET Request Method with Sensitive Query Strings.

This query detects GET requests with sensitive information handled by Java EE Servlets.

Relevant PR is PR# 4880

  • Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). We would love to have you spread the word about the good work you are doing

Result(s)

Provide at least one useful result found by your query, on some revision of a real project.
@luchua-bc luchua-bc added the All For One Submissions to the All for One, One for All bounty label Dec 26, 2020
@ghsecuritylab
Copy link
Collaborator

ghsecuritylab commented Jan 6, 2021

Your submission is now in status SecLab review.

For information, the evaluation workflow is the following:
CodeQL initial assessment > SecLab review > CodeQL review > SecLab finalize > Pay > Closed

@m-y-mo
Copy link
Contributor

m-y-mo commented Jan 25, 2021

@luchua-bc We've had an initial look at the results from your query. It seems that the query is currently flagging everything that comes from a HttpRequest instead of just the query string, which results in many false positives. It may be better to use isRequestGetParamMethod as a source instead. Would you be able to modify the query according and then we can take another look? Thanks.

@luchua-bc
Copy link
Author

luchua-bc commented Jan 26, 2021 •
edited by pwntester

Thanks @m-y-mo for reviewing this issue. I've committed the change to use isRequestGetParamMethod as the source instead. Please review again.

@pwntester
Copy link
Contributor

pwntester commented Feb 9, 2021

Hi @luchua-bc, the results look better now, but there are still too many FPs caused by the broad getCommonSensitiveInfoRegex predicate. I would suggest to reuse this predicate but exclude ^token$ and ^token.* since it seems the TPs are in the form of accessToken, authenticationToken, authToken, ...

@luchua-bc
Copy link
Author

luchua-bc commented Feb 9, 2021

Thanks @pwntester for reviewing this PR. I've made the requested change. Please review.

@ghsecuritylab
Copy link
Collaborator

ghsecuritylab commented Feb 15, 2021

Your submission is now in status CodeQL review.

For information, the evaluation workflow is the following:
CodeQL initial assessment > SecLab review > CodeQL review > SecLab finalize > Pay > Closed

@ghsecuritylab
Copy link
Collaborator

ghsecuritylab commented Mar 10, 2021

Your submission is now in status SecLab finalize.

For information, the evaluation workflow is the following:
CodeQL initial assessment > SecLab review > CodeQL review > SecLab finalize > Pay > Closed

@ghsecuritylab
Copy link
Collaborator

ghsecuritylab commented Mar 10, 2021

Your submission is now in status Pay.

For information, the evaluation workflow is the following:
CodeQL initial assessment > SecLab review > CodeQL review > SecLab finalize > Pay > Closed

@xcorail
Copy link
Contributor

xcorail commented Mar 10, 2021

Created Hackerone report 1122662 for bounty 282423 : [223] [Java] CWE-598: Use of GET Request Method with Sensitive Query Strings

@xcorail xcorail closed this as completed Mar 10, 2021
@ghsecuritylab
Copy link
Collaborator

ghsecuritylab commented Mar 10, 2021

Your submission is now in status Closed.

For information, the evaluation workflow is the following:
CodeQL initial assessment > SecLab review > CodeQL review > SecLab finalize > Pay > Closed

@luchua-bc
Copy link
Author

luchua-bc commented Mar 10, 2021

Thanks @xcorail for the quick turn-around and the bounty:-)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
All For One Submissions to the All for One, One for All bounty
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@pwntester @xcorail @m-y-mo @luchua-bc @ghsecuritylab