VNX-525: Use of Web Browser Cache Containing Sensitive Information

Detects authenticated or user-data responses that are explicitly made cacheable: Django @cache_page, Flask-Caching @cache.cached and @cache_control(public=True | max_age=N) stacked with @login_required and similar decorators, and a public or max-age Cache-Control header set in a handler that is authenticated or serves user data.

Field	Value
Rule ID	`VNX-525`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	JavaScript / TypeScript, Python
CWE	CWE-525
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`web-browser-cache` `cache-control` `cwe-525`
Source	`internal/sast/rules/vnx-525.rego`

Overview

VNX-525 maps to CWE-525: Use of Web Browser Cache Containing Sensitive Information. A response marked cacheable can be stored by a shared proxy or CDN, or by the browser of a shared computer, and shown to the next person. The rule reports:

Python: @cache_page, @cache.cached and @cache_control(public=True | max_age=N) stacked with an authentication decorator (@login_required, @permission_required, @user_passes_test, @staff_member_required, @jwt_required, @auth_required, @roles_required);
Python and JavaScript/TypeScript: a Cache-Control header set to public or a non-zero max-age/s-maxage (with no private, no-store or no-cache), or patch_cache_control(response, public=True | max_age=N), in a handler that is authenticated or serves user data (an auth decorator or middleware, request.user, current_user, req.user, req.session, a token or password, or a route such as /account, /profile, /me, /settings, /billing, /orders).

What Gets Flagged

@login_required
@cache_page(60 * 15)                                    # FLAGGED
def dashboard(request):
    return render(request, "dashboard.html", {"user": request.user})

router.get("/account", requireAuth, (req, res) => {
  res.set("Cache-Control", "public, max-age=600");     // FLAGGED
  res.json({ email: req.user.email });
});

What Is Not Flagged

The object form (res.set({ "Cache-Control": "public, max-age=300" })) is reported the same way.

no-store, no-cache and private policies; caching of public views, health checks and static assets; comments, strings and test code. A sensitive response with no Cache-Control at all is not reported, because whether a response is sensitive cannot be decided from one line.

Remediation

Send Cache-Control: no-store on authenticated and sensitive responses.
Do not use whole-page caching (cache_page, cache.cached) on views behind authentication; cache the data per user server-side if needed.
Where some caching is acceptable, use private, no-cache so only the user’s own browser keeps a copy and revalidates it.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-525
// nosec vnx-525

Or record an ignore rule: vulnetix ignore add --rule vnx-525 --reason "...". See Suppressing findings.