Hackers Can Manipulate Web Cache Keys to Access Restricted Data and Poison Websites

A web cache poisoning technique called cache key injection could let attackers access restricted data, disrupt websites, or poison cached pages with malicious content. Alex Brumen’s research shows attackers don’t always need to exploit unkeyed HTTP request values, the usual focus of cache poisoning attacks. Instead, they can abuse values that are already included in a cache key when a web server combines them without clear separators. Web caches improve performance by storing responses and serving them again when later requests generate the same cache key. In Nginx, a cache key may be built from parts of an HTTP request, including the protocol scheme, hostname, URI, query string, cookies, or headers. A common Nginx...

Read the full article at the source.