Password in plaintext in browser

  

Severity: Medium

Vulnerability description

Browsers will sometimes ask a user if they wish to remember the password that they just entered. The browser will then store the password, and automatically enter it whenever the same authentication form is visited. This is a convenience for the user. Having the browser store passwords is not only a convenience for end-users, but also for an attacker. If an attacker can gain access to the victim's browser (e.g. Through a Cross Site Scripting attack, or through a shared computer), then they can retrieve the stored passwords. It is observed that application allows the browse to store the password in plaintext.

Impact

If passwords are saved in plain text, the attacker to compromise the user accounts can use it.

Attack simulation

Password is shown in plain text in browser as save password popup.

Recommendation

Credentials should not store in plaintext in the browser.

Affected URLs/parameters