What Is Web Cache Poisoning? How Can a Cached Response Become a Security Problem?
Here's something that should be completely unremarkable. A user requests /homepage . The origin server generates a response. A cache stores it. The next user requests /homepage . The cache returns the stored response without touching the origin. That's caching working as intended. It reduces latency, saves origin load, and serves popular content efficiently. Nothing suspicious. Now ask a more…
Web cache poisoning is a security issue that arises when a cached response can be manipulated to serve malicious content to users. Here's how it works:
1. When a user requests a webpage, the request first goes through intermediaries like a browser, CDN, or reverse proxy before reaching the origin server.
2. The cache checks if it has a stored response for the requested URL. If it does, it serves that cached response to the user, reducing latency and saving resources.
3. The cache key is a representation of the request that determines which stored responses can be reused. This key is computed by the cache and is used to compare requests.
4. The cache key may not include all the details of the original request, such as certain headers or query parameters. This means that two requests with slight differences in their request components can be considered the same by the cache key.
5. If an attacker controls some parts of the request, they can craft two requests that appear identical to the cache but generate different responses from the origin server.
6. When the attacker requests a page, the cache computes its cache key (ignoring the attacker-controlled parts) and determines it's a cache miss. It then forwards the request to the origin server.
7. The origin server processes the request, including the attacker-controlled input, generates a response based on that input, and the cache stores this response using the cache key.
8. When another user (the victim) requests the same page, the cache computes the same cache key and finds a matching response in its storage. It serves the cached response to the victim.
9. The victim receives a response that was generated under conditions the attacker controlled, potentially exposing sensitive information or causing unexpected behavior.
Key points to remember:
- The cache itself is not compromised; it's functioning as intended by storing and serving cached responses.
- The security vulnerability lies in the mismatch between the cache key and the origin server's interpretation of the request.
- Any part of the request that influences the origin's response but is not included in the cache key can lead to cache poisoning.
- Modern applications often have multiple caching layers, making it more complex to ensure consistent behavior across all layers.
- Developers need to be aware of how caching layers interact with their application's response generation to avoid potential security issues.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
