Gotta Cache 'Em All: Bending the Rules of Web Cache Exploitation
PortSwigger researcher Martin Doyhenard presents new findings on web cache exploitation, highlighting how discrepancies between proprietary URL parsers in Content Delivery Networks (CDNs) and origin servers create significant security vulnerabilities. The research explores ambiguities in RFC specifications that lead to path confusion, allowing attackers to manipulate how HTTP servers and proxies parse specially crafted URLs. By leveraging these parser discrepancies, attackers can achieve arbitrary web cache poisoning and deception across numerous websites and CDN providers. The study details techniques involving delimiters, normalization, and key generation flaws, demonstrating how inconsistent handling of characters like semicolons in Java Spring or dots in Ruby on Rails can be exploited. These attacks enable the hijacking of sensitive information, such as authentication tokens and API keys, or the storage of malicious payloads. The paper serves as a comprehensive guide to understanding these novel attack vectors, offering insights into both offensive techniques and defensive strategies. It underscores the tip of the iceberg regarding cache security issues as CDNs become increasingly prevalent in modern web infrastructure, urging developers and security professionals to address these parsing inconsistencies to prevent potential account takeovers and data breaches.
Wire timeline
Gotta Cache 'Em All: Bending the Rules of Web Cache Exploitation
PortSwigger researcher Martin Doyhenard presents new findings on web cache exploitation, highlighting how discrepancies between proprietary URL parsers in Content Delivery Networks (CDNs) and origin servers create significant security vulnerabilities. The research explores ambiguities in RFC specifications that lead to path confusion, allowing attackers to manipulate how HTTP servers and proxies parse specially crafted URLs. By leveraging these parser discrepancies, attackers can achieve arbitrary web cache poisoning and deception across numerous websites and CDN providers. The study details techniques involving delimiters, normalization, and key generation flaws, demonstrating how inconsistent handling of characters like semicolons in Java Spring or dots in Ruby on Rails can be exploited. These attacks enable the hijacking of sensitive information, such as authentication tokens and API keys, or the storage of malicious payloads. The paper serves as a comprehensive guide to understanding these novel attack vectors, offering insights into both offensive techniques and defensive strategies. It underscores the tip of the iceberg regarding cache security issues as CDNs become increasingly prevalent in modern web infrastructure, urging developers and security professionals to address these parsing inconsistencies to prevent potential account takeovers and data breaches.
PortSwigger Research