airframes.org form submits ICAO code over plain HTTP

[zagers]

Security Vulnerability: Insecure Data Transport (Medium)

Description

The airframes.org lookup form submits the aircraft ICAO hex code via HTTP POST to http://www.airframes.org/. The ICAO code is sent in cleartext, and the response page loads in a new tab where it could be manipulated by a MITM attacker.

Location

• public_html/index.html:47 (form action)
• public_html/script.js:2494 (dynamic link generation in getAirframesModeSLink)

Impact

• ICAO address of tracked aircraft sent in cleartext
• Response page could be modified to serve malicious content
• Passive eavesdroppers can see which aircraft are being tracked

Suggested Fix

Change the form action and generated links to HTTPS:

<!-- index.html -->
<form id="airframes_post" action="https://www.airframes.org/" method="post" target="_blank">

// script.js - already fixed in PR #299
return "<a href=\"https://www.airframes.org/\" ..."

[mutability]

Does airframes actually work over HTTPS? Historically, it has been very very picky about what it accepts.

Passive eavesdroppers can see which aircraft are being tracked

no. the only way to trigger this is by deliberately interacting with a specific tracked aircraft in the browser and trying to go look at the airframes info.