Use of Web Browser Cache Containing Sensitive Information

Opis

The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.

Skutki

• Confidentiality

  Read Application Data

  Browsers often store information in a client-side cache, which can leave behind sensitive information for other users to find and exploit, such as passwords or credit card numbers. The locations at most risk include public terminals, such as those in libraries and Internet cafes.

Zapobieganie

• Architecture and Design

  Protect information stored in cache.

• Implementation

  Use a restrictive caching policy for forms and web pages that potentially contain sensitive information, such as "no-cache" in the Cache-Control header.

• Architecture and Design

  Do not store unnecessarily sensitive information in the cache.

• Architecture and Design

  Consider using encryption in the cache.

Przykłady podatności

• CVE-2024-30127 Product does not set the "no-cache" option in the HTTP Cache-Control, allowing sensitive information to be cached
• CVE-2024-45314 Login form for an application development framework does not set "no-cache" and other options in the HTTP Cache-Control header, allowing sensitive information to be cached

Słabość nadrzędna

• CWE-524 Use of Cache Containing Sensitive Information

Kiedy powstaje

• Implementation

Dotyczy

Not Language-Specific, Web Based, Web Server