Lab: Web cache poisoning via a fat GET request
Summary: This PortSwigger lab demonstrates web cache poisoning through a fat GET request: the site accepts GET requests that carry a body, but the cache key is derived only from the original callback parameter in the request line, not the body. Because a duplicate callback parameter passed in the body controls the name of the function called in the response, the lab is solved by poisoning the cache with a response that executes alert(1) in the browser of a user who regularly visits the home page in Chrome.
What you should know: The cache key ignores the request body, so an attacker can shape a cached response that every visitor to the home page receives - and the only proof of impact here is script execution in a real user's browser.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026