Cache Poisoning & Web Cache Deception
Purpose
Provide detection patterns for HTTP cache poisoning and web cache deception vulnerabilities, including proxy cache misconfigurations, cache key manipulation, and authenticated response caching.
OWASP Top 10 Mapping
Category: Related to A01 (Broken Access Control), A05 (Security Misconfiguration)
CWEs:
- CWE-524: Use of Cache Containing Sensitive Information
- CWE-525: Use of Web Browser Cache Containing Sensitive Information
- CWE-444: Inconsistent Interpretation of HTTP Requests
- CWE-436: Interpretation Conflict
When to Use
Activate this skill when:
- Reviewing proxy/CDN configurations (Nginx, Varnish, Cloudflare, etc.)
- Analyzing SSRF vulnerabilities for exfiltration vectors
- Auditing applications with static file caching
- Looking for authenticated content exposure
- Checking cache key construction for manipulation
Web Cache Deception
Overview
Web cache deception occurs when:
- Proxy caches responses based on file extension (e.g.,
.png,.css) - Application serves dynamic content regardless of path extension
- Attacker tricks victim into visiting
/profile.png - Proxy caches authenticated response
- Attacker retrieves cached sensitive data
Detection Patterns
Nginx Cache Configuration
# Find proxy cache configurations
grep -rniE "proxy_cache|proxy_cache_valid|proxy_cache_key" --include="*.conf" --include="nginx.conf"
# Check cache rules for static extensions (HIGH RISK)
grep -rniE "location.*\.(css|js|png|jpg|jpeg|gif|ico|svg|woff)" -A10 --include="*.conf" | grep -iE "proxy_cache|cache"
# Cache key analysis - look for missing user identification
grep -rniE "proxy_cache_key" --include="*.conf"
# Caching authenticated responses (CRITICAL if no Vary header)
grep -rniE "proxy_cache_valid\s+200" --include="*.conf"
Varnish Cache Configuration
# VCL cache rules
grep -rniE "vcl_recv|vcl_hash|vcl_backend_response" --include="*.vcl"
# Static extension caching
grep -rniE "req\.url.*\.(css|js|png|jpg|jpeg|gif|ico)" --include="*.vcl"
# Cache TTL settings
grep -rniE "set beresp\.ttl|beresp\.grace" --include="*.vcl"
Apache/mod_cache
# mod_cache configuration
grep -rniE "CacheEnable|CacheRoot|CacheMaxExpire" --include="*.conf" --include=".htaccess"
# Cache for specific paths
grep -rniE "CacheEnable.*disk" --include="*.conf"
CDN/Cloud Configurations
# Cloudflare/AWS CloudFront
grep -rniE "cache.*control|edge.*cache|cdn.*cache|cloudfront|cloudflare" --include="*.json" --include="*.yaml" --include="*.yml"
# Cache-Control headers
grep -rniE "Cache-Control|max-age|s-maxage|public|private" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"
Cache Key Manipulation
Detection Patterns
# Host header in requests (potential cache key manipulation)
grep -rniE "Host.*header|getHeader.*Host|X-Forwarded-Host|X-Original-Host" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"
# Query parameter handling
grep -rniE "query.*param|request\.query|getQueryString" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"
# Cache key includes query string?
grep -rniE "proxy_cache_key.*query|CacheKeyQueryString" --include="*.conf" --include="*.vcl"
Cache Key Injection via Headers
# X-Forwarded-* headers that might be in cache key
grep -rniE "X-Forwarded-Host|X-Forwarded-Scheme|X-Forwarded-Proto" --include="*.conf" --include="*.go" --include="*.py"
# Unkeyed headers that affect response
grep -rniE "X-Original-URL|X-Rewrite-URL" --include="*.conf" --include="*.go" --include="*.py"
SSRF + Cache Poisoning Chain
Overview
When SSRF response is not directly returned to attacker:
- Make SSRF request to
/sensitive-endpoint.png - Proxy caches the response (thinks it's static)
- Attacker requests same path
- Gets cached sensitive data
Detection Patterns
# SSRF endpoints that make internal requests
grep -rniE "requests\.get|http\.Get|fetch\(|axios\.|urllib" --include="*.py" --include="*.go" --include="*.js" --include="*.ts"
# User-controlled URLs in SSRF
grep -rniE "url.*=.*request|uri.*=.*request|callback.*=.*request" --include="*.py" --include="*.go" --include="*.js" --include="*.ts"
# Check if proxy caches the response path
grep -rniE "proxy_cache|cache_valid" -B5 -A5 --include="*.conf"
Verification Checklist for SSRF + Cache
- Can attacker control part of the request path?
- Does proxy cache responses based on path/extension?
- Can attacker add file extension to bypass cache rules?
- Is there a timing window to retrieve cached response?
Path Extension Abuse
Overview
Many caches use file extension to determine cacheability:
/api/user/profile- NOT cached (dynamic)/api/user/profile.png- CACHED (static file)
If the application ignores the extension and serves the same content, this enables cache deception.
Detection Patterns
# Flask/Django wildcard routes
grep -rniE "route.*<path:|path:subpath|<.*:.*>" --include="*.py"
# Express catch-all routes
grep -rniE "app\.get\('\*'|router\.get\('\*'|\.use\('\/'," --include="*.js" --include="*.ts"
# Nginx location blocks that proxy regardless of extension
grep -rniE "location\s+/|location\s+~" -A10 --include="*.conf" | grep -iE "proxy_pass"
# Check if routes handle extensions gracefully (ignore them)
grep -rniE "\.split\('\.\'\)|path\.extname|endswith|path.*extension" --include="*.py" --include="*.go" --include="*.js" --include="*.ts"
Response Caching of Authenticated Content
Detection Patterns
# Missing Vary header (should include Authorization/Cookie)
grep -rniE "Vary.*header|add_header.*Vary" --include="*.conf" --include="*.go" --include="*.py"
# Cache-Control: private not set for authenticated endpoints
grep -rniE "@login_required|@jwt_required|isAuthenticated|requireAuth" -A20 --include="*.py" --include="*.go" --include="*.js" --include="*.ts" | grep -iE "cache|response"
# Session/Cookie in cached responses
grep -rniE "Set-Cookie.*Cache|Cache-Control.*Set-Cookie" --include="*.conf" --include="*.py" --include="*.go"
Proper Cache Headers for Authenticated Content
Cache-Control: private, no-store, must-revalidate
Vary: Authorization, Cookie
CDN-Specific Patterns
Cloudflare
# Page Rules caching
grep -rniE "page.*rules|cache.*level|cache.*everything" --include="*.json" --include="*.tf"
# Bypass cache
grep -rniE "bypass.*cache|cache\.bypass" --include="*.json"
AWS CloudFront
# Cache behaviors
grep -rniE "CacheBehavior|DefaultCacheBehavior|CachePolicyId" --include="*.json" --include="*.yaml" --include="*.tf"
# Origin request policy
grep -rniE "OriginRequestPolicy|ForwardedValues" --include="*.json" --include="*.yaml"
Fastly/Akamai
# VCL snippets
grep -rniE "snippet|vcl_recv|vcl_hash" --include="*.vcl" --include="*.json"
# Edge logic
grep -rniE "edge.*cache|surrogate.*key" --include="*.json" --include="*.yaml"
Framework-Specific Checks
Django
# Cache framework usage
grep -rniE "django\.core\.cache|@cache_page|CACHES\s*=" --include="*.py"
# Vary header decorator
grep -rniE "@vary_on_headers|@vary_on_cookie" --include="*.py"
Express/Node.js
# Express static middleware
grep -rniE "express\.static|serve-static|maxAge" --include="*.js" --include="*.ts"
# Cache headers in responses
grep -rniE "res\.set.*Cache|setHeader.*Cache" --include="*.js" --include="*.ts"
Spring Boot
# Cache annotations
grep -rniE "@C