Lab: Exploiting cache server normalization for web cache deception
Summary: PortSwigger's lab walks through exploiting web cache deception by finding which characters an origin server treats as path delimiters: Intruder testing showed that #, ?, %23, and %3f returned 200 responses containing the user's API key, while # was ruled out because the victim's browser uses it as a delimiter before the request reaches the cache. The lab then confirms the cache decodes and resolves encoded dot-segments and applies a rule based on the /resources prefix, and uses the %23 delimiter with a cache buster to deliver an exploit that makes the victim carlos's API key appear in a cached response.
Why it matters: The exploit succeeds because the origin server and the cache disagree on where the path ends, so a response containing carlos's API key gets stored and served to the attacker. Any mismatch between how your origin parses a URL and how your CDN caches it is enough to leak authenticated data.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026