Gotta cache 'em all: bending the rules of web cache exploitation
Summary: PortSwigger researchers published a paper showing that popular CDNs and origin servers parse URLs differently, using different delimiter characters and inconsistent decoding and dot-segment normalization, which enables arbitrary web cache poisoning and web cache deception across many sites and CDN providers. The paper details testing methods for identifying delimiters, decoding behavior, and normalization at both the cache and origin server, and notes that servers like Apache and Nginx resolve URLs completely differently, making path confusion possible even without custom configuration.
What you should know: Because CDNs such as CloudFlare, Akamai, and CloudFront store responses for paths ending in static extensions like .js or .css, a delimiter mismatch between cache and origin can let an attacker store a victim's sensitive response and serve it to others - a path to token and API key hijacking and full account takeover.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026