STIGQter: STIG Summary: Application Security and Development Security Technical Implementation Guide Version: 5 Release: 1 Benchmark Date: 23 Oct 2020:

The application must not store sensitive information in hidden fields.

DISA Rule

SV-222601r508029_rule

Vulnerability Number

V-222601

Group Title

SRG-APP-000441

Rule Version

APSC-DV-002485

Severity

CAT I

CCI(s)

• CCI-002420 - The information system maintains the confidentiality and/or integrity of information during preparation for transmission.

Weight

10

Fix Recommendation

Design and configure the application to not store sensitive information in hidden fields.

Encrypt sensitive information stored in hidden fields using DoD-approved encryption and use server side session management techniques for user session management.

Check Contents

Interview application administrator and review application documentation to identify and familiarize with the application features and functions.

Request most recent code review and vulnerability scan results. Review test configuration to ensure testing for hidden fields was conducted. Review test results for incidents of hidden data fields.

Examine identified hidden fields and determine what type of data is stored in the hidden fields.

If the data stored in the hidden fields are determined to be authentication or session related data, or if the code review or vulnerability scan results are not available and configured to test for hidden fields, this is a finding.

Vulnerability Number

V-222601

Documentable

False

Rule Version

APSC-DV-002485

Severity Override Guidance

Interview application administrator and review application documentation to identify and familiarize with the application features and functions.

Request most recent code review and vulnerability scan results. Review test configuration to ensure testing for hidden fields was conducted. Review test results for incidents of hidden data fields.

Examine identified hidden fields and determine what type of data is stored in the hidden fields.

If the data stored in the hidden fields are determined to be authentication or session related data, or if the code review or vulnerability scan results are not available and configured to test for hidden fields, this is a finding.

Check Content Reference

M

Target Key

4093

Comments