vulns.co
/
GKData.io MCP

Back to Gadgets

Web cache deception via path confusion

Cache-deception is path confusion. The origin maps a decorated path to a private handler, and the cache stores that response because the path looks like a static asset or matches a cache rule. This is not cache poisoning: poisoning is unkeyed input that…

Tags: cache-deception, cdn, disclosure

Typical severity: P2-P4

What it becomes

Low alone if the cache never stores the private body, and it becomes disclosure when a personalized response is saved under a URL the cache treats as static.

Where to look

  • CDNs in front of apps that ignore extra path segments
  • cache rules keyed on a static extension or prefix
  • delimiter differences between the cache and the origin

Chains

  • Private data disclosure: An authenticated client you control requests the confusing path, the cache stores the private body, and a second clean client receives that body.
  • Credential or link leak: The stored body includes a still-valid link or anti-forgery value that was meant only for the authenticated caller.

Notes

  • Two clients you own. Do not trick a real user into visiting the URL, and do not leave their data in the cache.
  • If the response changes because of an unkeyed header, that is poisoning. File it separately.