URL Contains Sensitive Data - Credit Card Number

Description

Exposing sensitive data, such as credit card information, within the URL of a RESTful API endpoint poses a security vulnerability due to the potential for unauthorized access through various means, including browser history, server logs, and network sniffing. To mitigate this risk, sensitive data should never be included in the URL; instead, it should be transmitted securely using encrypted channels such as HTTPS and stored securely on the server side, adhering to PCI DSS compliance standards. Additionally, implementing tokenization or encryption techniques for sensitive data transmission and adopting security best practices can help prevent exploitation of this vulnerability.

Remediation

Remove or mask credit card numbers from URL parameters. Instead, send this sensitive information in the request body or via secure HTTP headers. Ensure that all communication is encrypted using HTTPS (TLS) to protect data in transit, and store credit card information in compliance with PCI DSS requirements. Consider using tokenization or other forms of encryption to further safeguard sensitive data. Regularly audit server logs, reverse proxies, or analytics tools to confirm no credit card details are inadvertently captured. Employ a Web Application Firewall (WAF) or intrusion detection system to detect suspicious attempts at exfiltrating card data, and periodically review application code to ensure that new or updated endpoints do not leak credit card information in URLs.

References

Severity

Owasp

Code: A02:2021

Category: Cryptographic Failures

Classification