Lab: Internal cache poisoning
Summary: PortSwigger's lab demonstrates web cache poisoning against a site that uses multiple layers of caching, with a victim user regularly visiting the home page in Chrome. The exercise requires poisoning the internal cache so the home page executes alert(document.cookie) in the victim's browser, and notes that the X-Forwarded-Host header is supported and can be set to an exploit server URL.
Bottom line: The attack path runs through a supported X-Forwarded-Host header and a cache layer sitting behind the edge, so a single poisoned entry can serve the payload to a regular Chrome user without any action on their part.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026