Description

Due to improper cache control an attacker can view sensitive information even if he is not logged into the account

Proof of Concept

1. Go to https://rdiffweb-demo.ikus-soft.com/login/ and login into your account using given credentials
2. Go to https://rdiffweb-demo.ikus-soft.com/admin/logs and this endpoint has the entire log
3. Click on Logout
4. Now press the back button of your browser
5. You will notice that you are still able to view the sensitive data/log files

Mitigation:
Cache-Control: private, no-cache, no-store, max-age=0
Pragma: no-cache
Expires: 0