Password field with autocomplete enabled

Description

Vulnerability Description: Most browsers have a facility to remember user credentials that are entered into HTML forms. This function can be configured by the user and also by applications that employ user credentials. If the function is enabled, then credentials entered by the user are stored on their local computer and retrieved by the browser on future visits to the same application.

 

Evidence: Following instances of this issue were identified, at the following locations:
/opennms/account/selfService/newPasswordEntry
/opennms/admin/userGroupView/users/newUser.jsp
/opennms/login.jsp
/opennms/login.jsp;jsessionid=node0195bty4d669od38s4yghr8p1t54869.node0
/opennms/support/index.htm

Evidence: Following instances of this issue were identified, at the following locations:
/opennms/account/selfService/newPasswordEntry
/opennms/admin/userGroupView/users/newUser.jsp
/opennms/login.jsp
/opennms/login.jsp;jsessionid=node0195bty4d669od38s4yghr8p1t54869.node0
/opennms/support/index.htm

 

 

Impact: The stored credentials can be captured by an attacker who gains control over the user's computer. Further, an attacker who finds a separate application vulnerability such as cross-site scripting may be able to exploit this to retrieve a user's browser-stored credentials.

Acceptance / Success Criteria

None

Attachments

1
  • 10 Dec 2021, 06:23 AM

related to

Lucidchart Diagrams

Activity

Jeff Gehlbach February 10, 2022 at 4:31 PM

yep, that's the one; thanks, and good sleuthing! Let's link https://opennms.atlassian.net/browse/NMS-12146#icft=NMS-12146 to this issue, perhaps as a "depends on".

Gerald Humphries February 10, 2022 at 3:05 PM

I think this is it: https://issues.opennms.org/browse/NMS-12146

Making the asset passwords non-autocomplete should fix that issue.

Jeff Gehlbach February 10, 2022 at 2:55 PM

  1. Help > Support, commercial support login: Should not autocomplete. Also, this flow no longer works, and should be removed for the time being (we need a separate issue for this)

  2. Configure users: Should not autocomplete.

  3. Asset fields marked as passwords: Should not autocomplete. There is a community-reported issue that should be linked to this context; I tried to track it down but failed with a quick search.

Gerald Humphries February 8, 2022 at 3:42 AM

I have some questions about the requirements for specific fields:

  1. Help > Support in the header will show a login form for Commercial Support. This looks like a separate set of credentials from the main login. Should this form use autocomplete, and should its autocomplete be separate from the main login if possible?

  2. Configuring users in the admin menu allows an admin user to set other user's passwords. Should password autocomplete be disabled here, like mentioned in the comment above?

  3. The "Asset" form that's accessible in Node information > Asset Info can show password fields. Should autocomplete be enabled or disabled here?

Gerald Humphries February 8, 2022 at 3:28 AM

There are several kinds of password fields throughout the application where we might not want to autocomplete.

For example, we may not want to save/autocomplete credentials when managing another user's password. 

[From MDN|https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion#preventing_autofilling_with_autocompletenew-password], these kinds of fields can have autocomplete turned off with autocomplete="new-password"

If you are defining a user management page where a user can specify a new password for another person, and therefore you want to prevent autofilling of password fields, you can use autocomplete="new-password".

 

Fixed

Details

Assignee

Reporter

HB Grooming Date

HB Backlog Status

Sprint

Affects versions

Priority

PagerDuty

Created December 10, 2021 at 6:24 AM
Updated March 17, 2022 at 8:05 PM
Resolved February 16, 2022 at 4:00 PM

Flag notifications