Hackers Can Manipulate Web Cache Keys to Access Restricted Data and Poison Websites
Researcher Alex Brumen demonstrates Nginx cache key injection enabling restricted-data access, cache-poisoned denial of service, and stored XSS.
Security researcher Alex Brumen published a web cache poisoning technique, cache key injection, that abuses cache keys built by concatenating request components without separators, such as Nginx's proxy_cache_key "$scheme$host$request_uri$http_accept". Key collisions can let attackers bypass access controls on paths like /admin, poison responses to cause cache-poisoned denial of service (CPDoS), and achieve stored XSS via HTTP/HTTPS scheme confusion with a malicious Host header. The research also shows attackers can bypass Cloudflare's edge cache using an Authorization header to poison the Nginx origin cache directly. Mitigations include using delimited or structured cache keys, avoiding caching of authenticated responses, and strict Host header validation.
- Cache key collisions arise when variable request components are concatenated without delimiters in Nginx keys.
- Key collision with /admin can return cached administrative responses to unauthorized external users.
- CPDoS scenario lets attackers cache a 404 that is later served for the legitimate /home page.
- HTTP/HTTPS scheme confusion can inject a malicious Host header, enabling stored XSS via attacker JavaScript.
- Cloudflare edge cache bypass via Authorization header allows direct poisoning of Nginx origin caches.
- Vendors
- NginxCloudflare
- Products
- Nginx
- Organizations
- YesWeHack
From the original article
3 min read at cybersecuritynews.com
A web cache poisoning technique called cache key injection could let attackers access restricted data, disrupt websites, or poison cached pages with malicious content. Alex Brumen’s research shows attackers don’t always need to exploit unkeyed HTTP request values, the usual focus of cache poisoning attacks. Instead, they can abuse values that are already included in […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.