Description

This detector identifies when sensitive form fields in HTML contain exposed values that should be protected. It searches for input fields containing sensitive information (like passwords, credit card numbers, SSNs) that have values visible in the HTML source code, which creates a security risk as this data can be accessed by anyone viewing the page source.

Detection Strategy

• Scans all HTML input elements in web page responses for sensitive field types based on field names, labels, or attributes

• Checks if these sensitive input fields contain actual values (not empty or placeholder text) that are exposed in the HTML source

• Reports a vulnerability when sensitive fields like passwords, credit card numbers, or personal identifiers have values populated in the HTML that could be viewed by inspecting the page source