Cache key / deception bypass
Make the CDN store a response the next user should never see, or store your poison under a popular key.
Tags: cache, cdn, xss
Techniques
Unkeyed header
Origin uses X-Forwarded-Host; CDN key does not. Poison links in cached HTML.
X-Forwarded-Host: evil.exampleX-Forwarded-Scheme: http
Unkeyed query / fat GET
Origin reads a query or body the cache ignores.
GET /path?utm_x= (if utm is unkeyed)GET /path with a JSON body
Static suffix deception
Path mapping so /account is cached as a CSS/JS file.
/account/settings/x.css/account%0a.css/account/..%2fstatic/x.js
Normalization disagree
CDN keys on the raw path, origin normalises. Two paths, one cache entry, or the reverse.
/static/../account/./account