Skip to main content

37. Web Cache Poisoning: Turning a CDN into an Attack Surface

Web caches improve performance, but a misconfigured cache becomes a target for cache poisoning. The key is to “produce different responses for the same URL, then plant one of those responses in the cache.”

Basic Scenario​

  • The server trusts headers such as X-Forwarded-Host, X-Host, and X-Original-URL
  • The cache key considers only the URL/query and ignores headers
  • The attacker uses a header to induce an open redirect, XSS, or a cache branch

For example, if a proxy generates absolute URLs from X-Forwarded-Host, the response will contain the attacker's domain. Once that response is cached, the next visitor receives the malicious response from the legitimate URL.

CTF/Real-World Checklist​

  • Inspect the Vary header; if it is absent, the cache key is narrow
  • Look for Cache-Control: public with a long TTL
  • Check whether the cache stores error responses too

Defensive Points​

  • Include trusted headers in the cache key
  • Configure Vary correctly
  • Allowlist headers at the proxy/application layer

A CDN is both shield and blade. Without understanding the cache policy, it becomes an attack surface rather than a defense.