Comment on page
Cache Poisoning and Cache Deception
What is the difference between web cache poisoning and web cache deception?
- In web cache poisoning, the attacker causes the application to store some malicious content in the cache, and this content is served from the cache to other application users.
- In web cache deception, the attacker causes the application to store some sensitive content belonging to another user in the cache, and the attacker then retrieves this content from the cache.
The goal of poisoning the cache is to make the clients load unexpected resources partially or totally controlled by the attacker. The poisoned response will only be served to users who visit the affected page while the cache is poisoned. As a result, the impact can range from non-existent to massive depending on whether the page is popular or not.
In order to perform a cache poisoning attack you need first to identify ukeyed inputs (parameters not needed to appear on the the cached request but that change the returned page), see how to abuse this parameter and get the response cached.
You could use Param Miner to brute-force parameters and headers that may be changing the response of the page. For example, a page may be using the header
X-Forwarded-Forto indicate the client to load script from there:
With the parameter/header identified check how it is being sanitised and where is it getting reflected or affecting the response from the header. Can you abuse it any any way (perform a XSS or load a JS code controlled by you? perform a DoS?...)
Once you have identified the page that can be abused, which parameter/header to use and how to abuse it you need to get the page cached. Depending on the resource you are trying to get in the cache this could time more or less time and some times you just will need to be trying several seconds. The header
X-Cachein the response could be very useful as it may have the value
misswhen the request wasn't cached and the value
hitwhen it is cached. The header
Cache-Controlis also interesting to know if a resource is being cached and when will be the next time the resource will be cached again:
Cache-Control: public, max-age=1800Another interesting header is
Vary. This header is often used to indicate additional headers that are treated as part of the cache key even if they are normally unkeyed. Therefore, if the user knows the
User-Agentof the victim he is targeting, he can poison the cache for the users using that specific
User-Agent. One more header related to the cache is
Age. It defines the times in seconds the object has been in the proxy cache.
When caching a request, be careful with the headers you use because some of them could be used unexpectedly as keyed and the victim will need to use that same header. Always test a Cache Poisoning with different browsers to check if it's working.
A header like
X-Forwarded-Foris being reflected in the response unsanitized> You can send a basic XSS payload and poison the cache so everybody that access page will be XSSed:
GET /en?region=uk HTTP/1.1
Note that this will poison a request to
Cookies could also be reflected on the response of a page. If you can abuse it to cause a XSS for example, you could be able to exploit XSS in several clients that load the malicious cache response.
GET / HTTP/1.1
Cookie: session=VftzO7ZtiBj5zNLRAuFpXpSQLjS4lBmU; fehost=asd"%2balert(1)%2b"
Note that if the vulnerable cookie is very used by the users, regular requests will be cleaning the cache.
Some time you will need to exploit several ukneyed inputs to be able to abuse a cache. For example, you may find an Open redirect if you set
X-Forwarded-Hostto a domain controlled by you and
http.If the server is forwarding all the HTTP requests to HTTPS and using the header
X-Forwarded-Schemeas domain name for the redirect. You can control where the pagepointed by the redirect.
GET /resources/js/tracking.js HTTP/1.1
If you found that the
X-Hostheader is being used as domain name to load a JS resource but the
Varyheader in the response is indicating
User-Agent. Then, you need to find a way to ex-filtrate the User-Agent of the victim and poison the cache using that user agent:
GET / HTTP/1.1
User-Agent: THE SPECIAL USER-AGENT OF THE VICTIM
The goal of Cache Deception is to make clients load resources that are going to be saved by the cache with their sensitive information. A very clear example can be found in this write-up: https://hackerone.com/reports/593712.
In the example it is explained that if you load a non-existent page like http://www.example.com/home.php/non-existent.css the content of http://www.example.com/home.php (with the users sensitive information) is going to be returned and the cache server is going to save the result. Then, the attacker can access http://www.example.com/home.php and see the confidential information of the users that accessed before.
Note that the cache proxy should be configured to cache files based on the extension of the file (.css) and not base on the content-type. In the example http://www.example.com/home.php/non-existent.css will have a
text/htmlcontent-type instead of a
text/cssmime type (which is the expected for a .css file).