Practical Web Cache Poisoning
Summary: PortSwigger researcher James Kettle published a paper showing how unkeyed inputs like HTTP headers can be used to poison web caches and deliver exploits to every visitor of a site's homepage. The paper demonstrates the technique against Red Hat, Unity, Mozilla, data.gov and Ghost, using an open source Burp extension called Param Miner to automate discovery of unkeyed inputs.
Bottom line: Kettle reports that data.gov and Ghost did nothing for months and only patched due to the threat of imminent publication, and that many of these exploits chain secondary vulnerabilities like XSS that are useless without cache poisoning to force a custom header onto another user's request.
Read the original at PortSwigger Research ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026