Medium Vulnerability Description
Page caching by the web browser is not disabled in many HTML pages throughout the application.
Impact
This vulnerability could allow sensitive application information to be recovered in clear-text from a browser’s cache in situations where a user logs in to the site via a shared computer (e.g., in a public library, a public Internet kiosk, etc.) or if a malicious user gained local access to a legitimate user’s workstation. Other information disclosures may also result from this condition. In some cases, after a user logs out of the application, a malicious user with local access to the victim’s workstation can press the browser’s “back” button in order to view the last page accessed by the user prior to logging out.
Verification and Attack Information
Praetorian identified this issue by observing Cache-Control headers sent in server responses and by manually viewing contents of the client’s local cache directory. Example evidence is shown below.
Recommendation
Set page-caching directives using three HTTP 1.0/1.1 headers for all pages containing sensitive or volatile data. The headers are:
Cache-Control: no-cache
Pragma: no-cache
Expires: -1
References
https://www.owasp.org/index.php/Category:WASS_Page_Caching
For Testing :
1. Open Login Page --> Inspect Element --> Network Tab --> Reload Page (Ctrl + F5)
2. Check Response Headers of all files --> Cache-Control, Pragma, Expires attributes are visible.
Assigning to Zeeshan
Cache control header for all pages is set to either private,public nochace or combination of them
It is suggested to set cache control :nocache
Zeeshan Chishty (Inactive)
added a comment - Cache control header for all pages is set to either private,public nochace or combination of them
It is suggested to set cache control :nocache For Sensitive data in pages we should implement
Cache-Control: no-cache, no-store, must-revalidate,
pre-check=0, post-check=0, max-age=0, s-maxage=0
Pragma:No cache
Expires:-1
Zeeshan Chishty (Inactive)
added a comment - For Sensitive data in pages we should implement
Cache-Control: no-cache, no-store, must-revalidate,
pre-check=0, post-check=0, max-age=0, s-maxage=0
Pragma:No cache
Expires:-1 Affected Pages for Cache Control
SearchEmployeeController.cs 1 Response Changed
WTHomePageController.cs 21 Response Changed
EmployeeProfileController.cs 4 Response Change
EnrollmentSummaryController.cs 5 Response Change
Note :
pre-check=0, post-check=0 is not necessary if these parameters are 0. So, this parameters are not added
Following is added in above pages.
Cache-Control: no-cache, no-store, must-revalidate, max-age=0, s-maxage=0
Please find the attachment for pages changed for Cache-Control Header
Page caching is enabled page wise.
Please check the attached excel-sheet for the pages affected:
Cache-Control-ed Modules.xls
Verified as cache control header is specified with values no cache, no store and max age:0
Pragma:no cache
Expires:-1
Zeeshan Chishty (Inactive)
added a comment - Verified as cache control header is specified with values no cache, no store and max age:0
Pragma:no cache
Expires:-1 Verified on stage as cache control header is specified with values no cache, no store and max age:0
Pragma:no cache
Expires:-1
Zeeshan Chishty (Inactive)
added a comment - Verified on stage as cache control header is specified with values no cache, no store and max age:0
Pragma:no cache
Expires:-1 Confirmed on Production cache control headers are set to no chache, no store wherever necessary.
Zeeshan Chishty (Inactive)
added a comment - Confirmed on Production cache control headers are set to no chache, no store wherever necessary. Rakesh Roy This should be verified for performance or any other functional issues.Please assign it if required
Zeeshan Chishty (Inactive)
added a comment - Rakesh Roy This should be verified for performance or any other functional issues.Please assign it if required Checked mentioned pages on production except for On Board and Wellness module
Steps to Configure Server for Page Caching Parameters
1. Open IIS Manager and Select Project (Site).
2. Open "HTTP Response Header" and Click on "Add" button from Actions pane.
3. Add following Name and Value:
i. Cache-Control: no-cache
ii. Expires: -1
iii. Pragma: no-cache
Note : This will edit Web.Config file of Web Projects