Password Autocomplete in Browser

By
Manieendar Mohan
Published on
02 Jul 2018
Vulnerability

Almost all browsers have the functionality that allows user to save username, password and other credentials that are entered into HTML forms. These credentials are saved in the local computer or in a cloud account provided by the browser. When a new credentials are entered in a form, the browser prompts if credentials should be saved. Thereafter when the same form is displayed, the name and password are filled in automatically or are completed as the name is entered. An attacker with local access could obtain the cleartext password from the browser cache.

Example

The following is the example of this vulnerability:-

        <INPUT TYPE="password" AUTOCOMPLETE="on">

    

Impact

The impact include:-

  • Attacker getting access to user credentials.
  • Possible loss of sensitive information.
  • Manipulation of sensitive information.

Mitigation / Precaution

This vulnerability can be fixed by:-

  • Disabling the password auto complete
        <INPUT TYPE="password" AUTOCOMPLETE="off">

    
Automated human-like penetration testing for your web apps & APIs
Teams using Beagle Security are set up in minutes, embrace release-based CI/CD security testing and save up to 65% with timely remediation of vulnerabilities. Sign up for a free account to see what it can do for you.

Written by
Manieendar Mohan
Manieendar Mohan
Cyber Security Lead Engineer
Find website security issues in a flash
Improve your website's security posture with proactive vulnerability detection.
Free website security assessment