STIGQter STIGQter: STIG Summary: Application Security and Development Security Technical Implementation Guide Version: 4 Release: 9 Benchmark Date: 25 Jan 2019: The application must not store sensitive information in hidden fields.

DISA Rule

SV-84877r1_rule

Vulnerability Number

V-70255

Group Title

SRG-APP-000441

Rule Version

APSC-DV-002485

Severity

CAT I

CCI(s)

Weight

10

Fix Recommendation

Design and configure the application to not store sensitive information in hidden fields.

Encrypt sensitive information stored in hidden fields using DoD-approved encryption and use server side session management techniques for user session management.

Check Contents

Interview application administrator and review application documentation to identify and familiarize with the application features and functions.

Request most recent code review and vulnerability scan results. Review test configuration to ensure testing for hidden fields was conducted. Review test results for incidents of hidden data fields.

Examine identified hidden fields and determine what type of data is stored in the hidden fields.

If the data stored in the hidden fields are determined to be authentication or session related data, or if the code review or vulnerability scan results are not available and configured to test for hidden fields, this is a finding.

Vulnerability Number

V-70255

Documentable

False

Rule Version

APSC-DV-002485

Severity Override Guidance

Interview application administrator and review application documentation to identify and familiarize with the application features and functions.

Request most recent code review and vulnerability scan results. Review test configuration to ensure testing for hidden fields was conducted. Review test results for incidents of hidden data fields.

Examine identified hidden fields and determine what type of data is stored in the hidden fields.

If the data stored in the hidden fields are determined to be authentication or session related data, or if the code review or vulnerability scan results are not available and configured to test for hidden fields, this is a finding.

Check Content Reference

M

Target Key

3009

Comments