Exploiting cache implementation flaws
Summary: PortSwigger Research documents how flaws in cache key generation let attackers poison caches through inputs normally considered unexploitable, including transformations that strip the port from the Host header or exclude the entire query string from the key. The techniques were first presented by Director of Research James Kettle as "Web Cache Entanglement: Novel Pathways to Poisoning" at BlackHat USA 2020.
What's compelling: When a cache excludes the query string from its key, a reflected XSS that once required luring a victim to a crafted URL becomes stored and is served to anyone visiting the ordinary page, with no further attacker interaction.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026