performing-web-cache-deception-attack

name	performing-web-cache-deception-attack
description	Execute web cache deception attacks by exploiting path normalization discrepancies between CDN caching layers and origin servers to cache and retrieve sensitive authenticated content.
domain	cybersecurity
subdomain	web-application-security
tags	["web-cache-deception","cdn-attack","cache-poisoning","path-normalization","cloudflare","cache-key","static-resource"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"]

Performing Web Cache Deception Attack

When to Use

• When testing applications behind CDNs or reverse proxies (Cloudflare, Akamai, Varnish, Nginx)
• During assessment of authenticated page caching behavior
• When evaluating path normalization differences between caching and origin layers
• During bug bounty hunting on applications with aggressive caching policies
• When testing for sensitive data exposure through cache layer misconfiguration

How to CONFIRM a Hit (avoid false negatives)

• Positive signal: an authenticated response gets stored under a static-looking path and is then readable by a completely anonymous client — confirm with the second, unauthenticated request returning the victim's data and X-Cache: HIT / CF-Cache-Status: HIT / Age > 0.
• The whole vulnerability lives in the second read: a single authenticated request that returns profile data proves nothing on its own.
• Do NOT conclude "not vulnerable" until you have:
  • Performed the anonymous follow-up (no cookies/no auth header) to the exact crafted URL and confirmed it returns the victim's private content.
  • Confirmed the response was actually cached (HIT / positive Age), not just that the origin echoed the page.
  • Tried multiple static extensions (.css .js .png .jpg .svg .ico .woff2) and multiple delimiter/normalization tricks (;, %2f, %3b, %00, ..%2f, /., case changes) — caching rules vary by extension and by path-parsing discrepancy.
  • Tested several authenticated endpoints (profile, settings, billing) since caching rules are path-specific.
  • Ruled out per-user Vary: Cookie keying that would make the "hit" actually serve a non-victim copy.

Prerequisites

• Understanding of HTTP caching mechanisms (Cache-Control, Vary, Age headers)
• Knowledge of CDN path normalization and cache key construction
• Burp Suite for intercepting and crafting requests
• Two browser sessions (authenticated victim and unauthenticated attacker)
• Understanding of URL path parsing differences across technologies
• Familiarity with common CDN platforms (Cloudflare, Akamai, Fastly, AWS CloudFront)