Web cache deception
Summary: Web cache deception is a vulnerability where an attacker tricks a web cache into storing sensitive, dynamic content by exploiting discrepancies between how the cache server and origin server handle requests. PortSwigger describes how an attacker persuades a victim to visit a malicious URL, inducing an ambiguous request that the cache misinterprets as a static resource and stores, which the attacker then retrieves.
What's compelling: The attack hinges on mismatches in URL path mapping and delimiter handling between cache and origin, so a single endpoint where the origin ignores an added path segment or static extension can expose private data to anyone who requests the cached URL.
Read the original at PortSwigger Research ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026