Browser cache weakness

 

 Browser cache weakness

Severity: Medium

Vulnerability description

Browsers can store information for purposes of caching and history. Caching is used to improve performance, so that previously displayed information doesn’t need to be downloaded again. History mechanisms are used for user convenience, so the user can see exactly what they saw at the time when the resource was retrieved. If sensitive information is displayed to the user (such as their address, credit card details, Social Security Number, or username), then this information could be stored for purposes of caching or history, and therefore retrievable through examining the browser’s cache or by simply pressing the browser’s Back button.

Impact

Browsers often store information in a client-side cache, which can leave behind sensitive information for other users to find and exploit, such as passwords or credit card numbers. The locations at most risk include public terminals, such as those in libraries and Internet cafes.

Attack simulation

 use the back button functionality after logout from the website and observe.

Recommendation

The web server should return the following HTTP headers in all responses containing sensitive content:

Cache-control: no-store

Pragma: no-cache

Affected URLs/Parameters