Fortinet 5.0 Patch 6 Preventing tampering with hidden inputs

Fortinet 430 FortiWeb 5.0 Patch 6 Administration Guide

See also

•Validating parameters (“input rules”)

Preventing tampering with hidden inputs

Unlike visible inputs, hidden field rules are for hidden parameters only, from

<input type="hidden"> HTML tags. For information on constraining visible inputs, see

“Validating parameters (“input rules”)”.

Hidden form inputs are often written into an HTML page by the web server when it serves that

page to the client, and are not visible on the rendered web page. Because HTTP is essentially

stateless, like cookies, hidden form inputs are one way that web applications can use to

remember session data from one page request to the next (called “persistence”).

For example, to remember the price of a TV accessed from a secret sale URL previously

requested that session, this form remembers the sale price, and will provide it again to the

shopping cart application when the client submits the payment page:

$900 x Quantity: <input name="quantity" size=4><br/>

</br>

</form>

Since they are not rendered visible, hidden inputs are sometimes erroneously perceived as safe.

But similar to session cookies, hidden form inputs store the software’s state information

client-side, instead of server-side. This makes it vulnerable.

Hidden fields are accessible through the JavaScript document object model (DOM).

Additionally, forms often use the HTTP POST method and send input to a URL (such as

/checkPayment.do) that legitimate clients never see, since the server replies with an HTTP

302 status code and the next URL in the Location: header, which the client then fetches

using the GET method and displays. Unless there is code to prevent it, however, attackers often

can easily send altered hidden inputs to this POST URL simply by altering a local copy of the

page, using a browser plug-in tool such as Tamper Data, or in some cases simply typing

different URL parameters into the browser’s location bar.

Like any other input from clients, it can be tampered with and should not be trusted. Tampered

hidden inputs can be used as a vector for state-based attacks.

To follow the above example, an attacker could alter the sale price so that he or she can buy the

item much more cheaply:

$900 x Quantity: <input name="quantity" size=4><br/>

</br>

</form>