Skip to main content

Cached form fields

Description​

The application does not disable caching of input fields, thus the information will be stored in the browser's cache.

Impact​

Obtain valid users of the application.

Recommendation​

The data cache to browsers level must be disabled using some of these methods:

  • Use HTTP control headers that prevent cache.
  • Use meta-tags in HTML pages.
  • Disable the autocomplete field to prevent cache to fields level.

Threat​

Anonymous attacker from local network.

Expected Remediation Time​

⌚ 15 minutes.

Score​

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base​

  • Attack vector: L
  • Attack complexity: L
  • Privileges required: N
  • User interaction: R
  • Scope: U
  • Confidentiality: L
  • Integrity: N
  • Availability: N

Temporal​

  • Exploit code madurity: X
  • Remediation level: X
  • Report confidence: X

Result​

  • Vector string: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:X/RL:X/RC:X
  • Score:
    • Base: 3.3
    • Temporal: 3.3
  • Severity:
    • Base: Low
    • Temporal: Low

Code Examples​

Compliant code​

The http headers of the application are set to prevent cache

GET /tutorials/other/top-20-mysql-best-practices/ HTTP/1.1
Host: hostname
User-Agent: Mozilla/5.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Cache-control: no-cache

Example without cache type vulnerabilities

<html>
  <head>
    <title>Webpage without cache type vulnerabilities</title>
    <META HTTP-EQUIV="Pragma" CONTENT="no-cache">
    <META HTTP-EQUIV="Expires" CONTENT="-1">
    <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=utf-8">
  </head>
  <body>
      <form autocomplete="off" onsubmit="return false;">
        <label>Email</label>
        <input autofocus="autofocus" class="form-control" id="username" type="email" autocomplete="off"/>
        <label>Password</label><input class="form-control" id="password" type="password" autocomplete="off"/>
        <button class="btn btn-primary btn-block" id="btn-login">
          &nbsp; Sign In
        </button>
      </form>
  </body>
  <script src="https://example.com/example-framework.js"
      integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC">
  </script>
  <link href="/media/examples/link-element-example.css" rel="stylesheet"
      integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC">
  </link>
</html>

Non compliant code​

There are forms in the application that allow for auto-complete functionalities, also the application does not use meta tags to disable browsers cache

<!DOCTYPE html>
<html>
  <head>
    <title>Cache type vulnerabilities</title>
    <meta charset="UTF-8" />
  </head>
  <body>
    <form action="/help/readerlogin-auth" method="POST">
      <input type="hidden" name="r" value="/help/" />
      <div class="form-group">
        <label class="control-label" for="password">Username:</label>
        <input type="text" id="username" name="username" class="form-control" />
      </div>
      <div class="form-group">
        <label class="control-label" for="password">Password:</label>
        <input type="password" id="password" name="password" class="form-control" />
      </div>
      <div class="col-lg-4 pw-reset-link">
          <a href="#" data-toggle="modal" id="pw-reset-link" data-target="#hg-password-reset">Reset Password</a>
        </div>
        <div class="text-right">
        <button type="submit" class="btn btn-primary">Submit</button>
      </div>
    </form>
  </body>
  <script src="https://example.com/example-framework.js">
  </script>
  <link href="/media/examples/link-element-example.css" rel="stylesheet">
  </link>
</html>

Requirements​

free trial

Search for vulnerabilities in your apps for free with our automated security testing! Start your 21-day free trial and discover the benefits of our Continuous Hacking Machine Plan. If you prefer a full service that includes the expertise of our ethical hackers, don't hesitate to contact us for our Continuous Hacking Squad Plan.