Lab: Exploiting HTTP request smuggling to perform web cache deception
Summary: This PortSwigger lab sets up a front-end and back-end server pair where the front-end does not support chunked encoding and caches static resources. The goal is to perform a request smuggling attack so the next user's request causes their API key to be saved in the cache, then retrieve that key from the cache and submit it as the solution, after waiting 30 seconds from accessing the lab before tricking the victim.
Key Takeaway: The attack chains two flaws - a parsing mismatch between front-end and back-end servers and a cache that stores what it should not - so one user's smuggled request ends up writing another user's API key into a shared cache any subsequent visitor can read.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026