Forest Global Training Partners

Cyber Risks · PortSwigger Research

Lab: Exploiting exact-match cache rules for web cache deception

Summary: PortSwigger's lab walks through exploiting an exact-match cache rule: the origin server treats ';' and '?' as path delimiters, and the cache normalizes a path like /my-account;%2f%2e%2e%2frobots.txt to /robots.txt, so a request for that URL returns the victim's /my-account response with the administrator's CSRF token and an X-Cache: hit header. The attacker delivers that URL to the victim, retrieves the cached token within 30 seconds, and uses it in a generated CSRF proof-of-concept to change the administrator's email address.

What you should know: The whole exploit hinges on a mismatch between how the cache and the origin parse the same URL - the cache saw /robots.txt, the origin served /my-account - and the payoff was the administrator's CSRF token sitting in a cached response. If your cache rule matches on file extension or exact filename while your origin honors delimiters like ';', any authenticated page can end up stored and served to whoever asks next.

Read the original at PortSwigger Research ↗

Topics
Vulnerabilities & Patching
Related