The application must not store sensitive information in hidden fields.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-70255	APSC-DV-002485	SV-84877r1_rule		High

Description
Hidden fields allow developers to process application data without having to display it on the screen. Using hidden fields to pass data in forms is a common practice among web applications and by itself is not a security risk. However, hidden fields are not secure and can be easily manipulated by users. Information requiring confidentiality or integrity protections must not be placed in a hidden field. If data that is sensitive must be stored in a hidden field, it must be encrypted. Furthermore, hidden fields used to control access decisions can lead to a complete compromise of access control mechanisms allowing immediate compromise of the user's application session.

Description

Hidden fields allow developers to process application data without having to display it on the screen. Using hidden fields to pass data in forms is a common practice among web applications and by itself is not a security risk. However, hidden fields are not secure and can be easily manipulated by users. Information requiring confidentiality or integrity protections must not be placed in a hidden field. If data that is sensitive must be stored in a hidden field, it must be encrypted. Furthermore, hidden fields used to control access decisions can lead to a complete compromise of access control mechanisms allowing immediate compromise of the user's application session.

STIG	Date
Application Security and Development Security Technical Implementation Guide	2018-12-24

Details

Check Text ( C-70731r1_chk )
Interview application administrator and review application documentation to identify and familiarize with the application features and functions. Request most recent code review and vulnerability scan results. Review test configuration to ensure testing for hidden fields was conducted. Review test results for incidents of hidden data fields. Examine identified hidden fields and determine what type of data is stored in the hidden fields. If the data stored in the hidden fields are determined to be authentication or session related data, or if the code review or vulnerability scan results are not available and configured to test for hidden fields, this is a finding.

Check Text ( C-70731r1_chk )

Interview application administrator and review application documentation to identify and familiarize with the application features and functions.

Request most recent code review and vulnerability scan results. Review test configuration to ensure testing for hidden fields was conducted. Review test results for incidents of hidden data fields.

Examine identified hidden fields and determine what type of data is stored in the hidden fields.

If the data stored in the hidden fields are determined to be authentication or session related data, or if the code review or vulnerability scan results are not available and configured to test for hidden fields, this is a finding.

Fix Text (F-76491r1_fix)
Design and configure the application to not store sensitive information in hidden fields. Encrypt sensitive information stored in hidden fields using DoD-approved encryption and use server side session management techniques for user session management.