Web cache deception
Summary: Web cache deception exploits discrepancies between cache proxy and backend parsers, causing web servers to cache and serve dynamic content as though it were static. Attackers typically add fake static file extensions to dynamic URLs, such as changing "/path" to "/path/WCD.css", so the cache treats the response as a static resource and serves the user's sensitive information to later unauthorized requesters.
Bottom line: Because web caches are distributed, a single web cache deception attack can expose sensitive data across many users and sessions, and the cached page keeps being served to anyone who requests the same URL.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026