New Cache Key Injection Attack Lets Hackers Bypass Access Controls and Poison Nginx Caches
YesWeHack researcher details cache key injection against Nginx, enabling access control bypass, cache poisoning, denial of service, and potential stored XSS.
YesWeHack's Alex Brumen shows that Nginx cache keys built by concatenating variables without separators, such as '$scheme$host$request_uri$http_accept', allow crafted requests to collide with legitimate cache entries. Proofs of concept demonstrate bypassing a localhost-only /admin restriction, cache-poisoned denial of service returning 404s for valid pages, and HTTP/HTTPS scheme confusion enabling stored XSS when Host headers are reflected into script sources. Requests containing Authorization headers can also bypass Cloudflare's edge cache to poison an Nginx origin cache. Mitigations include delimited or structured cache keys, Host header validation, and excluding authenticated requests from shared caches.
- Unseparated variable concatenation lets distinct requests collide into the same Nginx cache key
- PoC bypasses localhost-only /admin restriction via cache key collision
- CPDoS variant serves attacker-induced 404 responses for legitimate pages
- HTTP/HTTPS scheme confusion with reflected Host headers can yield stored XSS
- Authorization headers can bypass Cloudflare and poison the origin cache
- Vendors
- NginxCloudflareYesWeHack
From the original article
2 min read at gbhackers.com
Security researchers have unveiled a cache poisoning technique called cache key injection that lets attackers bypass access controls, expose cached sensitive pages, trigger denial-of-service conditions, and potentially execute stored cross-site scripting (XSS) attacks against vulnerable Nginx deployments.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.