Re: GET and POST Methods Accepted

["Joe Teff" <joe () joeteff com>]

GET parameters are cached in the browser and logged on the server (I'm 
assuming SSL here). This can lead to replay attempts and data exposure.

If your site expects POST requests, then a GET request can respresent an 
attack (someone is trying values in the address line or maybe scripted).

Joe Teff


-----Original Message-----
From: "Welsh, Ed" <Ed.Welsh () fishnetsecurity com>
To: <webappsec () securityfocus com>
Date: Wed, 12 Oct 2005 15:04:06 -0500
Subject: GET and POST Methods Accepted

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> I have begun stating this as an issue during assessments and wonder
> what you folks think of it.
>
> Web sites are allowing a switch in method for requests and still
> processing the input.  I have been
> able to analyze a site login form which is specified to use POST method
> and craft a URL (GET of
> course) that the web server will still accept and process.  If the site
> will accept the GET method for
> form data and is vulnerable to XSS, the attack surface greatly
> increases over a site that is
> vulnerable to XSS but only accepts the POST method.  POST is still
> attackable, but it becomes more
> complicated than simply emailing a link.
>
> There used to be a substantial difference in how variables received via
> GET vs POST were stored.  That
> difference had to be accounted for in the server code and would not
> lend itself to arbitrary method
> switching.  This may disclose some of my ignorance, but it seems
> something has changed and application
> systems are treating input values the same regardless of the method.
>
> I have seen this recently on J2EE sites and CGI (PERL, PYTHON, Binary).
>
> Do any of you test for this issue - what are your results?
>
> Any other discussion is valued.
>
> Ed Welsh
> -----BEGIN PGP SIGNATURE-----
> Version: PGP Desktop 9.0.2 (Build 2424)
>
> iQEVAwUBQ01sNlcLJH9lmXCIAQgowAgAz4eUyEgXKIk7aveM09znkQVy4rUm640w
> 7M9XwRC2XnHo49MIc2CLsBa6d2yFbBsfhjw0L+hNRhWVnWRZsBv1Z+k61slZK0QU
> qeQS4f3+6iVgqesLsRtFG6d7DI50tDuVFpIkrwosLL4OkVLFHrA56x3BkrByverx
> pYa6SMihDMrVRl5dvIGecijObexHLM03gEembyTB2XJC5h+5Z3UNaGqt6kf4X0Dz
> Y3pfBdQ5OH8XdVReW+AZJAimd40g/+qiiYhMbeKJzC0p3/7Yw1VOG9//OPKFi/wY
> q79op1KikDcZ7l29YdI323gfI2G5WS3rJsdP00wM9X2IFEsdYR7n3A==
> =zb7v
> -----END PGP SIGNATURE-----