/cache-poisoning

name: Cache Poisoning
description: This skill should be used when the user asks about "cache poisoning", "web cache deception", "CDN cache", "proxy cache", "nginx cache", "varnish", "cache key manipulation", "response caching", or needs to find cache-related vulnerabilities during whitebox security review.
version: 1.0.0

Cache Poisoning & Web Cache Deception

Purpose

Provide detection patterns for HTTP cache poisoning and web cache deception vulnerabilities, including proxy cache misconfigurations, cache key manipulation, and authenticated response caching.

OWASP Top 10 Mapping

**Category**: Related to A01 (Broken Access Control), A05 (Security Misconfiguration)

**CWEs**:

• CWE-524: Use of Cache Containing Sensitive Information
• CWE-525: Use of Web Browser Cache Containing Sensitive Information
• CWE-444: Inconsistent Interpretation of HTTP Requests
• CWE-436: Interpretation Conflict

When to Use

Activate this skill when:

• Reviewing proxy/CDN configurations (Nginx, Varnish, Cloudflare, etc.)
• Analyzing SSRF vulnerabilities for exfiltration vectors
• Auditing applications with static file caching
• Looking for authenticated content exposure
• Checking cache key construction for manipulation

---

Web Cache Deception

Overview

Web cache deception occurs when: 1. Proxy caches responses based on file extension (e.g., `.png`, `.css`) 2. Application serves dynamic content regardless of path extension 3. Attacker tricks victim into visiting `/profile.png` 4. Proxy caches authenticated response 5. Attacker retrieves cached sensitive data

Detection Patterns

Nginx Cache Configuration

# Find proxy cache configurations
grep -rniE "proxy_cache|proxy_cache_valid|proxy_cache_key" --include="*.conf" --include="nginx.conf"

# Check cache rules for static extensions (HIGH RISK)
grep -rniE "location.*\.(css|js|png|jpg|jpeg|gif|ico|svg|woff)" -A10 --include="*.conf" | grep -iE "proxy_cache|cache"

# Cache key analysis - look for missing user identification
grep -rniE "proxy_cache_key" --include="*.conf"

# Caching authenticated responses (CRITICAL if no Vary header)
grep -rniE "proxy_cache_valid\s+200" --include="*.conf"

Varnish Cache Configuration

# VCL cache rules
grep -rniE "vcl_recv|vcl_hash|vcl_backend_response" --include="*.vcl"

# Static extension caching
grep -rniE "req\.url.*\.(css|js|png|jpg|jpeg|gif|ico)" --include="*.vcl"

# Cache TTL settings
grep -rniE "set beresp\.ttl|beresp\.grace" --include="*.vcl"

Apache/mod_cache

# mod_cache configuration
grep -rniE "CacheEnable|CacheRoot|CacheMaxExpire" --include="*.conf" --include=".htaccess"

# Cache for specific paths
grep -rniE "CacheEnable.*disk" --include="*.conf"

CDN/Cloud Configurations

# Cloudflare/AWS CloudFront
grep -rniE "cache.*control|edge.*cache|cdn.*cache|cloudfront|cloudflare" --include="*.json" --include="*.yaml" --include="*.yml"

# Cache-Control headers
grep -rniE "Cache-Control|max-age|s-maxage|public|private" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

---

Cache Key Manipulation

Detection Patterns

# Host header in requests (potential cache key manipulation)
grep -rniE "Host.*header|getHeader.*Host|X-Forwarded-Host|X-Original-Host" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

# Query parameter handling
grep -rniE "query.*param|request\.query|getQueryString" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

# Cache key includes query string?
grep -rniE "proxy_cache_key.*query|CacheKeyQueryString" --include="*.conf" --include="*.vcl"

Cache Key Injection via Headers

# X-Forwarded-* headers that might be in cache key
grep -rniE "X-Forwarded-Host|X-Forwarded-Scheme|X-Forwarded-Proto" --include="*.conf" --include="*.go" --include="*.py"

# Unkeyed headers that affect response
grep -rniE "X-Original-URL|X-Rewrite-URL" --include="*.conf" --include="*.go" --include="*.py"

---

SSRF + Cache Poisoning Chain

Overview

When SSRF response is not directly returned to attacker: 1. Make SSRF request to `/sensitive-endpoint.png` 2. Proxy caches the response (thinks it's static) 3. Attacker requests same path 4. Gets cached sensitive data

Detection Patterns

# SSRF endpoints that make internal requests
grep -rniE "requests\.get|http\.Get|fetch\(|axios\.|urllib" --include="*.py" --include="*.go" --include="*.js" --include="*.ts"

# User-controlled URLs in SSRF
grep -rniE "url.*=.*request|uri.*=.*request|callback.*=.*request" --include="*.py" --include="*.go" --include="*.js" --include="*.ts"

# Check if proxy caches the response path
grep -rniE "proxy_cache|cache_valid" -B5 -A5 --include="*.conf"

Verification Checklist for SSRF + Cache

• [ ] Can attacker control part of the request path?
• [ ] Does proxy cache responses based on path/extension?
• [ ] Can attacker add file extension to bypass cache rules?
• [ ] Is there a timing window to retrieve cached response?

---

Path Extension Abuse

Overview

Many caches use file extension to determine cacheability:

• `/api/user/profile` - NOT cached (dynamic)
• `/api/user/profile.png` - CACHED (static file)

If the application ignores the extension and serves the same content, this enables cache deception.

Detection Patterns

# Flask/Django wildcard routes
grep -rniE "route.*<path:|path:subpath|<.*:.*>" --include="*.py"

# Express catch-all routes
grep -rniE "app\.get\('\*'|router\.get\('\*'|\.use\('\/'," --include="*.js" --include="*.ts"

# Nginx location blocks that proxy regardless of extension
grep -rniE "location\s+/|location\s+~" -A10 --include="*.conf" | grep -iE "proxy_pass"

# Check if routes handl