Web cache poisoning¶

Web cache poisoning is an advanced technique whereby an attacker exploits the behaviour of a web server and cache so that a harmful HTTP response is served to other users.

A poisoned web cache can potentially be a devastating means of distributing numerous different attacks, exploiting vulnerabilities such as XSS, JavaScript injection, open redirection, and so on.

Still found in web apps using CDNs, reverse proxies, or caching layers.

Still a threat due to complex caching systems (misconfigs in Varnish, Cloudflare, Fastly, etc.), attackers using chained attacks to poison at scale (HTTP Request Smuggling + Cache Poisoning), and unkeyed inputs (Headers like X-Forwarded-Host can alter cached responses).