Lab: Exploiting path mapping for web cache deception
Summary: PortSwigger's lab walks through a web cache deception attack in which adding an arbitrary path segment to /my-account still returns the account page, and appending a .js extension causes the cache to store the response, shown by X-Cache changing from miss to hit within the 30-second max-age window. The exploit delivers a crafted URL to the victim carlos so his cached account response, including his API key, can be retrieved.
What's compelling: The origin server and the cache disagreed on what /my-account/abc.js meant, and that gap let one user's API key be served to another; any cache rule keyed on file extension rather than the full path carries the same exposure.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026