Web cache deception via path confusion
Cache-deception is path confusion. The origin maps a decorated path to a private handler, and the cache stores that response because the path looks like a static asset or matches a cache rule. This is not cache poisoning: poisoning is unkeyed input that…
Tags: cache-deception, cdn, disclosure
Typical severity: P2-P4
What it becomes
Low alone if the cache never stores the private body, and it becomes disclosure when a personalized response is saved under a URL the cache treats as static.
Where to look
CDNs in front of apps that ignore extra path segmentscache rules keyed on a static extension or prefixdelimiter differences between the cache and the origin
Chains
- Private data disclosure: An authenticated client you control requests the confusing path, the cache stores the private body, and a second clean client receives that body.
- Credential or link leak: The stored body includes a still-valid link or anti-forgery value that was meant only for the authenticated caller.
Notes
- Two clients you own. Do not trick a real user into visiting the URL, and do not leave their data in the cache.
- If the response changes because of an unkeyed header, that is poisoning. File it separately.