Lab: Cache key injection
Summary: PortSwigger's Web Security Academy lab presents a site with multiple independent vulnerabilities, including cache key injection, where a user regularly visits the home page using Chrome. Solving it requires combining the vulnerabilities to execute alert(1) in the victim's browser, using the Pragma: x-get-cache-key header and exploiting a flawed regex at /login that excludes the utm_content parameter from the cache key, allowing arbitrary unkeyed content to be appended to the lang parameter.
Why it matters: The lab turns on a single flawed regex that leaves utm_content out of the cache key, which is enough to let an attacker append unkeyed content to another parameter and poison the cache for every Chrome user who visits the home page.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026