CWE-1473 Improper Expiration of Cached Data

The product uses or supports data in a cache, but it does not properly specify an expiration with a date, time, or time period that is sufficient for the intended security policy of the product or its adminstrators.

• Access Control, Integrity, Other: Gain Privileges or Assume Identity, Bypass Protection Mechanism, Unexpected State, Varies by Context — If the cached data is used for security-critical functionality such as authentication, authorization, or identity, then this might allow users or adversaries to perform operations beyond their expected lifetime. If the data is old but used for identification, such as DNS lookup results, then the stale data could point to entities that are no longer controlled by the intended owner.

• [Architecture and Design, Implementation] For each type of cached data, determine the best lifetime that balances efficiency provided by the cache with the security implications of the data becoming too stale. Explicitly specify an expiration date or time period.

• [REF-1581]: RESTful search engine caches DNS hostname lookups forever in order to prevent DNS spoofing attacks, but it will not be able to detect when the hostnames resolve to a different IP address.