Web Cache Poisoning

HighWeb Application SecurityA05:2021 – Security Misconfiguration

Manipulating cache key inputs causes servers to store and serve malicious responses to other users, enabling cross-site scripting, open redirect injection, and security header bypass.

Immediate Response

1Purge the affected cache entries immediately.
2Identify and block the unkeyed input being exploited at the reverse proxy.
3Review cache configuration to determine which headers and parameters are unkeyed.
4Assess the impact on users who received poisoned responses.

All playbooks

1Include all headers and parameters that influence responses in cache keys.
2Avoid using user-controlled input to construct response content for cacheable routes.
3Set appropriate Cache-Control headers to prevent caching of dynamic responses.
4Implement cache-busting mechanisms for security-sensitive responses.

Long-term Prevention

1Conduct cache poisoning assessments as part of regular penetration testing.
2Use cache-aware security testing in CI/CD pipelines.
3Review cache configuration changes with security impact analysis.
4Implement web application firewall rules to block known cache poisoning patterns.

Attack vectors

Unkeyed headers (X-Forwarded-Host, X-Original-URL) used in response generation but excluded from cache keys
Unkeyed query parameters that influence response content without invalidating cached entries
Fat GET requests with unkeyed body content that modifies cached responses
Cache deception through path normalization differences between cache and origin

Indicators of compromise

Users receiving responses containing content intended for other users
Cached responses with unexpected headers or injected script content
Inconsistent application behavior between cache hits and origin responses
Security headers missing from cached responses that should include them

Tooling

Burp Suite (Param Miner extension)Cache Poisoning ScannerHTTPiecurl