Vulnerability Description
Page caching by the web browser is not disabled in many HTML pages throughout the application.
Impact
This vulnerability could allow sensitive application information to be recovered in clear-text from a browser’s cache in situations where a user logs in to the site via a shared computer (e.g., in a public library, a public Internet kiosk, etc.) or if a malicious user gained local access to a legitimate user’s workstation. Other information disclosures may also result from this condition. In some cases, after a user logs out of the application, a malicious user with local access to the victim’s workstation can press the browser’s “back” button in order to view the last page accessed by the user prior to logging out.
Verification and Attack Information
Praetorian identified this issue by observing Cache-Control headers sent in server responses and by manually viewing contents of the client’s local cache directory. Example evidence is shown below.
Recommendation
Set page-caching directives using three HTTP 1.0/1.1 headers for all pages containing sensitive or volatile data. The headers are:
Cache-Control: no-cache
Pragma: no-cache
Expires: -1
*Vulnerability Description*
Page caching by the web browser is not disabled in many HTML pages throughout the application.
*Impact*
This vulnerability could allow sensitive application information to be recovered in clear-text from a browser’s cache in situations where a user logs in to the site via a shared computer (e.g., in a public library, a public Internet kiosk, etc.) or if a malicious user gained local access to a legitimate user’s workstation. Other information disclosures may also result from this condition. In some cases, after a user logs out of the application, a malicious user with local access to the victim’s workstation can press the browser’s “back” button in order to view the last page accessed by the user prior to logging out.
*Verification and Attack Information*
Praetorian identified this issue by observing Cache-Control headers sent in server responses and by manually viewing contents of the client’s local cache directory. Example evidence is shown below.
*Recommendation*
Set page-caching directives using three HTTP 1.0/1.1 headers for all pages containing sensitive or volatile data. The headers are:
Cache-Control: no-cache
Pragma: no-cache
Expires: -1
*Vulnerability Description*
Page caching by the web browser is not disabled in many HTML pages throughout the application.
*Impact*
This vulnerability could allow sensitive application information to be recovered in clear-text from a browser’s cache in situations where a user logs in to the site via a shared computer (e.g., in a public library, a public Internet kiosk, etc.) or if a malicious user gained local access to a legitimate user’s workstation. Other information disclosures may also result from this condition. In some cases, after a user logs out of the application, a malicious user with local access to the victim’s workstation can press the browser’s “back” button in order to view the last page accessed by the user prior to logging out.
*Verification and Attack Information*
Praetorian identified this issue by observing Cache-Control headers sent in server responses and by manually viewing contents of the client’s local cache directory. Example evidence is shown below.
*Recommendation*
Set page-caching directives using three HTTP 1.0/1.1 headers for all pages containing sensitive or volatile data. The headers are:
Cache-Control: no-cache
Pragma: no-cache
Expires: -1
Steps to Configure Server for Page Caching Parameters
1. Open IIS Manager and Select Project (Site).
2. Open "HTTP Response Header" and Click on "Add" button from Actions pane.
3. Add following Name and Value:
i. Cache-Control: no-cache
ii. Expires: -1
iii. Pragma: no-cache
Note : This will edit Web.Config file of Web Projects
Niteen Surwase (Inactive)
added a comment - - edited Steps to Configure Server for Page Caching Parameters
1. Open IIS Manager and Select Project (Site).
2. Open "HTTP Response Header" and Click on "Add" button from Actions pane.
3. Add following Name and Value :
i. Cache-Control : no-cache
ii. Expires : -1
iii. Pragma : no-cache
Note : This will edit Web.Config file of Web Projects
Zeeshan Chishty (Inactive)
added a comment - Cache control header for all pages is set to either private,public nochace or combination of them
It is suggested to set cache control :nocache
For Sensitive data in pages we should implement
Cache-Control: no-cache, no-store, must-revalidate,
pre-check=0, post-check=0, max-age=0, s-maxage=0
Pragma:No cache
Expires:-1
Zeeshan Chishty (Inactive)
added a comment - For Sensitive data in pages we should implement
Cache-Control: no-cache, no-store, must-revalidate,
pre-check=0, post-check=0, max-age=0, s-maxage=0
Pragma:No cache
Expires:-1
Note :
pre-check=0, post-check=0 is not necessary if these parameters are 0. So, this parameters are not added Following is added in above pages. Cache-Control: no-cache, no-store, must-revalidate, max-age=0, s-maxage=0
Niteen Surwase (Inactive)
added a comment - - edited Note :
pre-check=0, post-check=0 is not necessary if these parameters are 0. So, this parameters are not added
Following is added in above pages.
Cache-Control : no-cache, no-store, must-revalidate, max-age=0, s-maxage=0
Niteen Surwase (Inactive)
added a comment - Page caching is enabled page wise.
Please check the attached excel-sheet for the pages affected:
Cache-Control-ed Modules.xls
Zeeshan Chishty (Inactive)
added a comment - Verified as cache control header is specified with values no cache, no store and max age:0
Pragma:no cache
Expires:-1
Zeeshan Chishty (Inactive)
added a comment - Verified on stage as cache control header is specified with values no cache, no store and max age:0
Pragma:no cache
Expires:-1
Zeeshan Chishty (Inactive)
added a comment - Rakesh Roy This should be verified for performance or any other functional issues.Please assign it if required
Medium 
Zeeshan Chishty (Inactive)
added a comment - Cache control header for all pages is set to either private,public nochace or combination of them
It is suggested to set cache control :nocache 
Steps to Configure Server for Page Caching Parameters
1. Open IIS Manager and Select Project (Site).
2. Open "HTTP Response Header" and Click on "Add" button from Actions pane.
3. Add following Name and Value:
i. Cache-Control: no-cache
ii. Expires: -1
iii. Pragma: no-cache
Note : This will edit Web.Config file of Web Projects