What is Use of HTTP Request With Sensitive Query (CWE-598)?

TL;DR: Use of HTTP Request With Sensitive Query String (CWE-598) is a vulnerability where sensitive data appears in an HTTP request’s query string, allowing attackers to intercept and misuse it. To fix this, move sensitive information into the request body or headers.

What is Use of HTTP Request With Sensitive Query String?

Use of HTTP Request With Sensitive Query String (CWE-598) is a type of vulnerability where sensitive information is included in the query string of an HTTP request. As defined by the MITRE Corporation under CWE-598, and classified by the OWASP Foundation under A06:2025 - Insecure Design.

Quick Summary

Use of HTTP Request With Sensitive Query String occurs when web applications transmit sensitive information via the query string in HTTP requests. This exposes data to interception or manipulation, leading to unauthorized access and potential security breaches. Jump to: [Overview] · [How It Works] · [Business Impact] · [Attack Scenario] · [Detection] · [Fixing] · [Framework-Specific Fixes] · [Ask AI] · [Best Practices Checklist] · [FAQ]

Jump to: Quick Summary · Use of HTTP Request With Sensitive Query String Overview · How Use of HTTP Request With Sensitive Query String Works · Business Impact of Use of HTTP Request With Sensitive Query String · Use of HTTP Request With Sensitive Query String Attack Scenario · How to Detect Use of HTTP Request With Sensitive Query String · How to Fix Use of HTTP Request With Sensitive Query String · Framework-Specific Fixes for Use of HTTP Request With Sensitive Query String · How to Ask AI to Check Your Code for Use of HTTP Request With Sensitive Query String · Use of HTTP Request With Sensitive Query String Best Practices Checklist · Use of HTTP Request With Sensitive Query String FAQ · Vulnerabilities Related to Use of HTTP Request With Sensitive Query String · References · Scan Your Own Site

Use of HTTP Request With Sensitive Query String Overview

What: A vulnerability where sensitive information is included in the query string of an HTTP request.

Why it matters: Exposes data to interception and manipulation, leading to unauthorized access and potential security breaches.

Where it occurs: In web applications that transmit sensitive data via GET requests or other HTTP methods with exposed query strings.

Who is affected: Web application users whose sensitive information can be intercepted or manipulated by attackers.

Who is NOT affected: Systems where sensitive data is transmitted securely, such as in request bodies or headers.

How Use of HTTP Request With Sensitive Query String Works

Root Cause

The root cause lies in the insecure transmission of sensitive information via query strings instead of more secure methods like POST requests or encrypted cookies.

Attack Flow

1. An attacker intercepts an HTTP request containing a query string with sensitive data.
2. The attacker extracts and uses this sensitive information for malicious purposes, such as session hijacking or unauthorized access.

Prerequisites to Exploit

• Sensitive information must be included in the query string of an HTTP request.
• The attacker needs network access to intercept the request.

Vulnerable Code

def get_user_data(user_id):
    url = f'/user/{user_id}?session_token={session_token}'
    response = requests.get(url)

This code is vulnerable because it includes a session token in the query string, making it visible and potentially accessible to unauthorized users.

Secure Code

def get_user_data(user_id):
    headers = {'Authorization': f'Bearer {session_token}'}
    url = f'/user/{user_id}'
    response = requests.get(url, headers=headers)

This code is secure because the session token is transmitted in an HTTP header rather than a query string.

Business Impact of Use of HTTP Request With Sensitive Query String

Confidentiality

• Data Exposure: Attackers can intercept and read sensitive information such as session tokens or API keys.
• Financial Losses: Unauthorized access to user accounts can lead to financial fraud and loss.

Integrity

• Unauthorized Access: Attackers can use intercepted data to impersonate legitimate users, leading to unauthorized actions.

Availability

• Service Disruption: Malicious actors may exploit vulnerabilities to disrupt services by launching denial-of-service attacks or causing system instability.

Business Consequences:

• Financial losses due to fraud and theft.
• Compliance violations due to data breaches.
• Damage to reputation from publicized security incidents.

Use of HTTP Request With Sensitive Query String Attack Scenario

1. An attacker intercepts an HTTP request containing a session token in the query string.
2. The attacker extracts the session token from the intercepted request.
3. Using the stolen session token, the attacker gains unauthorized access to user accounts.
4. The attacker performs malicious actions such as transferring funds or changing account settings.

How to Detect Use of HTTP Request With Sensitive Query String

Manual Testing

• Review all HTTP requests for sensitive information in query strings.
• Check if sensitive data is transmitted via POST requests instead of GET methods.
• Verify that secure headers and cookies are used for transmitting sensitive information.

Automated Scanners (SAST / DAST)

Static analysis can detect patterns where sensitive information appears in query strings. Dynamic testing involves intercepting live HTTP traffic to identify exposed data.

PenScan Detection

PenScan’s scanner engines such as ZAP, Nuclei, and Wapiti can flag instances of sensitive data in HTTP request query strings.

False Positive Guidance

A finding is real if the intercepted data appears in a query string and can be used for malicious purposes. A false positive occurs when the pattern looks risky but is actually safe due to context not visible to the scanner (e.g., encrypted or obfuscated).

How to Fix Use of HTTP Request With Sensitive Query String

• Move sensitive information into request bodies.
• Transmit sensitive data via secure headers instead of query strings.
• Avoid using GET methods for operations involving sensitive data.
• Implement proper session management and use secure cookies.

Framework-Specific Fixes for Use of HTTP Request With Sensitive Query String

Python/Django

def get_user_data(request):
    user_id = request.GET.get('user_id')
    headers = {'Authorization': f'Bearer {request.session["session_token"]}'}
    response = requests.get(f'/user/{user_id}', headers=headers)

How to Ask AI to Check Your Code for Use of HTTP Request With Sensitive Query String

Use of HTTP Request With Sensitive Query String Best Practices Checklist

✅ Review all HTTP requests to ensure sensitive information is not included in query strings. ✅ Transmit sensitive data via POST requests or secure headers instead of GET methods. ✅ Implement proper session management and use secure cookies for transmitting sensitive information. ✅ Regularly audit codebases for instances where sensitive data may be exposed through HTTP request parameters.

Use of HTTP Request With Sensitive Query String FAQ

How does Use of HTTP Request With Sensitive Query String work?

It occurs when sensitive information is included in the query string of an HTTP request, making it visible and potentially accessible to unauthorized users.

Why should I be concerned about Use of HTTP Request With Sensitive Query String?

Attackers can intercept or manipulate these requests to gain access to sensitive data such as session identifiers, passwords, and API keys.

Can you provide an example of vulnerable code for Use of HTTP Request With Sensitive Query String?

A GET request that includes a user’s session ID in the query string is an example of this vulnerability.

How can I detect Use of HTTP Request With Sensitive Query String in my application?

Manual testing involves reviewing HTTP requests and checking if sensitive information appears in the query string. Automated scanners can also identify such patterns.

What are some best practices to prevent Use of HTTP Request With Sensitive Query String?

Move sensitive data into request bodies or headers instead of query strings, and avoid using GET methods for operations involving sensitive data.

How do I fix Use of HTTP Request With Sensitive Query String in my code?

Replace the use of sensitive information in query strings with secure alternatives like POST requests or encrypted cookies.

Can you give an example of a real-world impact from Use of HTTP Request With Sensitive Query String?

An attacker could steal session IDs and hijack user sessions, leading to unauthorized access to user accounts.

Vulnerabilities Related to Use of HTTP Request With Sensitive Query String

References

• MITRE
• OWASP Insecure Design
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Use of HTTP Request With Sensitive Query String and other risks before an attacker does.