Lab: Web cache poisoning with an unkeyed cookie
Summary: PortSwigger's Web Security Academy lab demonstrates web cache poisoning where cookies are excluded from the cache key: the site sets a fehost=prod-cache-01 cookie and reflects its value inside a double-quoted JavaScript object in the response. The solution places an XSS payload such as fehost=someString"-alert(1)-"someString in the cookie, replays the request until the response shows X-Cache: hit, then removes the cache buster and keeps replaying so the poisoned response is served to a regular visitor.
What you should know: The cache stores one poisoned response and serves it to every visitor who requests that page, so a single crafted cookie value can turn into script execution in an unsuspecting user's browser without any further action from the attacker.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026