#vulns.co
/
mcp by GKData.io

← Back to Gadgets

Unkeyed header / cache key

X-Forwarded-Host, X-Forwarded-Scheme, X-Original-URL, Accept, Origin, cookie-less User-Agent, and unkeyed query params that the app uses to build links or JS.

Tags: cache, xss, cdn

Typical severity: P2-P4

What it becomes

If a header changes the response but is not in the cache key, you poison everyone who shares that key.

Where to look

  • CDN in front of a framework
  • Next.js / Nuxt with Host-based URL generation
  • static asset caches

Chains

  • Stored XSS — Poison a cached HTML/JS page with a reflected header that writes a script src or a base href.
  • Open redirect at scale — Poison Location or asset URLs so every cache hit leaves the site.
  • Web cache deception — Path mapping like /account/settings/x.css so a personalised page is stored as a static asset.

Notes

  • PortSwigger's cache-key gadgets (fat GET, unkeyed query, unkeyed header, unkeyed cookie) are the checklist.
  • Always confirm the poisoned response is served to a second, clean client.

← Back to Gadgets