Skip to main content

Sensitive data stored in client-side storage

Description

The application stores sensitive information in the client-side storage (localStorage or sessionStorage). This exposes the information to unauthorized read operations.

Impact

Obtain sensitive information through XSS or MitB attacks.

Recommendation

Do not use the client side storage to store sensitive information, use cookies instead by defining their respective security attributes.

Threat

Attacker with physical or virtual access to the victims browser.

Expected Remediation Time

⌚ 120 minutes.

Score

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base

  • Attack vector: N
  • Attack complexity: H
  • Privileges required: N
  • User interaction: R
  • Scope: U
  • Confidentiality: L
  • Integrity: N
  • Availability: N

Temporal

  • Exploit code madurity: X
  • Remediation level: X
  • Report confidence: X

Result

  • Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:X/RL:X/RC:X
  • Score:
    • Base: 3.1
    • Temporal: 3.1
  • Severity:
    • Base: Low
    • Temporal: Low

Code Examples

Compliant code

Local storage should only be used for non sensitive data storage

localStorage.setItem('whatever','non-sensitive');
localStorage.getItem(non.sensitive);

Non compliant code

Password and session ids are stored in the client side using tools like local storage

localStorage.getItem('password');
localStorage.setItem('whatever', sessionID);
localStorage.setItem(token.jwt, '123');
localStorage.getItem(session_token);

Requirements