Exploiting cache design flaws
Summary: PortSwigger Research describes web cache poisoning as arising when a site handles unkeyed input unsafely and caches the resulting response, with the simplest case being unkeyed input reflected in a cacheable response without sanitization. It walks through examples including the unkeyed X-Forwarded-Host header generating an Open Graph image URL that can be poisoned with an XSS payload served to all users requesting /en?region=uk, unkeyed headers used to point resource imports at attacker-controlled JavaScript, and cookie-based poisoning where a language preference cached without the Cookie header serves the Polish version to all users.
Bottom line: A single poisoned cache entry is served to every user whose request matches the cache key, so one crafted request can deliver an XSS payload or malicious script import to an entire population rather than one victim. The source also notes that responses revealing cache purge timing let an attacker time a single request to land the payload instead of bombarding the back-end, which keeps the attack quiet.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026