Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Cache key injection: Smuggling poison through the door

yeswehack.com | blog | #cloudflare | #stored-xss | #nginx | #cpdos | #web-cache-poisoning | #cache-key-injection | #cache-deception

Summary

How ambiguous NGINX cache keys can enable access-control bypasses, cache deception, CPDoS, stored XSS and origin cache poisoning.
Published
Collected

original ↗

Related coverage

research · portswigger.net
Bypassing Web Cache Poisoning Countermeasures
James Kettle examines and bypasses vendor countermeasures to web cache poisoning from Cloudflare, Akamai and Fastly, flagging pitfalls like cacheable block pages enabling DoS.
blog · yeswehack.com
HTTP header hacks: basic and advanced exploit techniques explored
Guide to abusing HTTP headers for high-impact bugs: response header recon, custom and Vary headers, header fuzzing, Cache-Poisoned DoS on Akamai and Cloudflare, and cache collision exploits.
blog · yeswehack.com
Web application firewall bypass
Bypassing web application firewalls after a flaw is found: abusing regex and blacklist weaknesses, normalisation quirks and frontend/backend filter collisions to slip payloads past WAFs.
blog · bishopfox.com
Shynet | VERSION 0.13.1
Bishop Fox's audit of Shynet 0.13.1 found two unauthenticated flaws: stored XSS via analytics location/referrer fields, and password-reset poisoning via a spoofed Host header; fixed in 0.14.0.
blog · bishopfox.com
YunoHost 2.7.2 to 2.7.14 - Multiple Vulnerabilities
YunoHost 2.7.2 to 2.7.14 vulnerabilities: stored XSS in profile fields (CVE-2018-11348) and an HTTP header injection (CVE-2018-11347) that together can hijack user sessions.
blog · bishopfox.com
Wallabag 2.2.3 to 2.3.2 - Stored Cross-Site Scripting
A stored XSS in Wallabag 2.2.3 through 2.3.2 (CVE-2018-11352) hides in the settings page and fires when an administrator visits it, enabling session theft.
back