Description

Detects when cache control headers are set to public, which could expose sensitive information by allowing responses to be stored in shared caches. This vulnerability could lead to unauthorized access to cached data that should remain private between the server and specific users.

Detection Strategy

• Check for new object creation that sets cache control to public

• Monitor assignments to cache control properties that enable public caching

• Identify cache configuration in HTTP response headers that explicitly set public access

• Flag instances where cache-control headers are configured to allow public caching of potentially sensitive responses

Vulnerable code example

using System.Net.Http.Headers;
using System;

public class CacheExample 
{
    public CacheControlHeaderValue CreateCache() 
    {
        var cacheControl = new CacheControlHeaderValue();...

✅ Secure code example

using System.Net.Http.Headers;
using System;

public class CacheExample 
{
    public CacheControlHeaderValue CreateCache() 
    {
        var cacheControl = new CacheControlHeaderValue();...