Lab: Exploiting origin server normalization for web cache deception
Summary: PortSwigger's lab walks through exploiting a mismatch between origin server and cache path handling: the origin server treats '?' as its only path delimiter and decodes encoded dot-segments like /aaa/..%2fmy-account to reach /my-account, while the cache applies a static rule to any path starting with /resources and does not resolve the dot-segment. The exploit /resources/..%2fmy-account returns carlos's API key with an X-Cache: miss header that flips to hit on resend, so delivering that URL to the victim stores their account response in the cache for the attacker to retrieve.
Bottom line: The gap here is a single encoded dot-segment: the cache sees a static /resources path while the origin sees /my-account, and the victim's API key ends up readable by anyone who requests the same URL. If your CDN and your origin disagree on how they parse a path, every authenticated page behind a cache rule is a candidate for the same trick.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026