Cache Poisoning

# Cache Poisoning & Web Cache Deception

## Purpose

Provide detection patterns for HTTP cache poisoning and web cache deception vulnerabilities, including proxy cache misconfigurations, cache key manipulation, and authenticated response caching.

## OWASP Top 10 Mapping

**Category**: Related to A01 (Broken Access Control), A05 (Security Misconfiguration)

**CWEs**:
- CWE-524: Use of Cache Containing Sensitive Information
- CWE-525: Use of Web Browser Cache Containing Sensitive Information
- CWE-444: Inconsistent Interpretation of HTTP Requests
- CWE-436: Interpretation Conflict

## When to Use

Activate this skill when:
- Reviewing proxy/CDN configurations (Nginx, Varnish, Cloudflare, etc.)
- Analyzing SSRF vulnerabilities for exfiltration vectors
- Auditing applications with static file caching
- Looking for authenticated content exposure
- Checking cache key construction for manipulation

---

## Web Cache Deception

### Overview

Web cache deception occurs when:
1. Proxy caches responses based on file extension (e.g., `.png`, `.css`)
2. Application serves dynamic content regardless of path extension
3. Attacker tricks victim into visiting `/profile.png`
4. Proxy caches authenticated response
5. Attacker retrieves cached sensitive data

### Detection Patterns

#### Nginx Cache Configuration

```bash
# Find proxy cache configurations
grep -rniE "proxy_cache|proxy_cache_valid|proxy_cache_key" --include="*.conf" --include="nginx.conf"

# Check cache rules for static extensions (HIGH RISK)
grep -rniE "location.*\.(css|js|png|jpg|jpeg|gif|ico|svg|woff)" -A10 --include="*.conf" | grep -iE "proxy_cache|cache"

# Cache key analysis - look for missing user identification
grep -rniE "proxy_cache_key" --include="*.conf"

# Caching authenticated responses (CRITICAL if no Vary header)
grep -rniE "proxy_cache_valid\s+200" --include="*.conf"
```

#### Varnish Cache Configuration

```bash
# VCL cache rules
grep -rniE "vcl_recv|vcl_hash|vcl_backend_response" --include="*.vcl"

# Static extension caching
grep -rniE "req\.url.*\.(css|js|png|jpg|jpeg|gif|ico)" --include="*.vcl"

# Cache TTL settings
grep -rniE "set beresp\.ttl|beresp\.grace" --include="*.vcl"
```

#### Apache/mod_cache

```bash
# mod_cache configuration
grep -rniE "CacheEnable|CacheRoot|CacheMaxExpire" --include="*.conf" --include=".htaccess"

# Cache for specific paths
grep -rniE "CacheEnable.*disk" --include="*.conf"
```

#### CDN/Cloud Configurations

```bash
# Cloudflare/AWS CloudFront
grep -rniE "cache.*control|edge.*cache|cdn.*cache|cloudfront|cloudflare" --include="*.json" --include="*.yaml" --include="*.yml"

# Cache-Control headers
grep -rniE "Cache-Control|max-age|s-maxage|public|private" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"
```

---

## Cache Key Manipulation

### Detection Patterns

```bash
# Host header in requests (potential cache key manipulation)
grep -rniE "Host.*header|getHeader.*Host|X-Forwarded-Host|X-Original-Host" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

# Query parameter handling
grep -rniE "query.*param|request\.query|getQueryString" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

# Cache key includes query string?
grep -rniE "proxy_cache_key.*query|CacheKeyQueryString" --include="*.conf" --include="*.vcl"
```

### Cache Key Injection via Headers

```bash
# X-Forwarded-* headers that might be in cache key
grep -rniE "X-Forwarded-Host|X-Forwarded-Scheme|X-Forwarded-Proto" --include="*.conf" --include="*.go" --include="*.py"

# Unkeyed headers that affect response
grep -rniE "X-Original-URL|X-Rewrite-URL" --include="*.conf" --include="*.go" --include="*.py"
```

---

## SSRF + Cache Poisoning Chain

### Overview

When SSRF response is not directly returned to attacker:
1. Make SSRF request to `/sensitive-endpoint.png`
2. Proxy caches the response (thinks it's static)
3. Attacker requests same path
4. Gets cached sensitive data

### Detection Patterns

```bash
# SSRF endpoints that make internal requests
grep -rniE "requests\.get|http\.Get|fetch\(|axios\.|urllib" --include="*.py" --include="*.go" --include="*.js" --include="*.ts"

# User-controlled URLs in SSRF
grep -rniE "url.*=.*request|uri.*=.*request|callback.*=.*request" --include="*.py" --include="*.go" --include="*.js" --include="*.ts"

# Check if proxy caches the response path
grep -rniE "proxy_cache|cache_valid" -B5 -A5 --include="*.conf"
```

### Verification Checklist for SSRF + Cache

- [ ] Can attacker control part of the request path?
- [ ] Does proxy cache responses based on path/extension?
- [ ] Can attacker add file extension to bypass cache rules?
- [ ] Is there a timing window to retrieve cached response?

---

## Path Extension Abuse

### Overview

Many caches use file extension to determine cacheability:
- `/api/user/profile` - NOT cached (dynamic)
- `/api/user/profile.png` - CACHED (static file)

If the application ignores the extension and serves the same content, this enables cache deception.

### Detection Patterns

```bash
# Flask/Django wildcard routes
grep -rniE "route.*<path:|path:subpath|<.*:.*>" --include="*.py"

# Express catch-all routes
grep -rniE "app\.get\('\*'|router\.get\('\*'|\.use\('\/'," --include="*.js" --include="*.ts"

# Nginx location blocks that proxy regardless of extension
grep -rniE "location\s+/|location\s+~" -A10 --include="*.conf" | grep -iE "proxy_pass"

# Check if routes handle extensions gracefully (ignore them)
grep -rniE "\.split\('\.\'\)|path\.extname|endswith|path.*extension" --include="*.py" --include="*.go" --include="*.js" --include="*.ts"
```

---

## Response Caching of Authenticated Content

### Detection Patterns

```bash
# Missing Vary header (should include Authorization/Cookie)
grep -rniE "Vary.*header|add_header.*Vary" --include="*.conf" --include="*.go" --include="*.py"

# Cache-Control: private not set for authenticated endpoints
grep -rniE "@login_required|@jwt_required|isAuthenticated|requireAuth" -A20 --include="*.py" --include="*.go" --include="*.js" --include="*.ts" | grep -iE "cache|response"

# Session/Cookie in cached responses
grep -rniE "Set-Cookie.*Cache|Cache-Control.*Set-Cookie" --include="*.conf" --include="*.py" --include="*.go"
```

### Proper Cache Headers for Authenticated Content

```
Cache-Control: private, no-store, must-revalidate
Vary: Authorization, Cookie
```

---

## CDN-Specific Patterns

### Cloudflare

```bash
# Page Rules caching
grep -rniE "page.*rules|cache.*level|cache.*everything" --include="*.json" --include="*.tf"

# Bypass cache
grep -rniE "bypass.*cache|cache\.bypass" --include="*.json"
```

### AWS CloudFront

```bash
# Cache behaviors
grep -rniE "CacheBehavior|DefaultCacheBehavior|CachePolicyId" --include="*.json" --include="*.yaml" --include="*.tf"

# Origin request policy
grep -rniE "OriginRequestPolicy|ForwardedValues" --include="*.json" --include="*.yaml"
```

### Fastly/Akamai

```bash
# VCL snippets
grep -rniE "snippet|vcl_recv|vcl_hash" --include="*.vcl" --include="*.json"

# Edge logic
grep -rniE "edge.*cache|surrogate.*key" --include="*.json" --include="*.yaml"
```

---

## Framework-Specific Checks

### Django

```bash
# Cache framework usage
grep -rniE "django\.core\.cache|@cache_page|CACHES\s*=" --include="*.py"

# Vary header decorator
grep -rniE "@vary_on_headers|@vary_on_cookie" --include="*.py"
```

### Express/Node.js

```bash
# Express static middleware
grep -rniE "express\.static|serve-static|maxAge" --include="*.js" --include="*.ts"

# Cache headers in responses
grep -rniE "res\.set.*Cache|setHeader.*Cache" --include="*.js" --include="*.ts"
```

### Spring Boot

```bash
# Cache annotations
grep -rniE "@Cacheable|@CacheEvict|@CachePut" --include="*.java"

# Spring Cache configuration
grep -rniE "spring\.cache|CacheManager|EhCache|Redis" --include="*.properties" --include="*.yaml"
```

### Go

```bash
# HTTP caching libraries
grep -rniE "httpcache|groupcache|bigcache" --include="*.go"

# Cache-Control headers
grep -rniE "Cache-Control|w\.Header\(\)\.Set" --include="*.go"
```

---

## Cross-Layer Analysis

### Verification Steps

When analyzing cache vulnerabilities, check all layers:

1. **Application Layer**
   - Does app handle path extensions?
   - What data is in authenticated responses?
   - Are Cache-Control headers set?

2. **Proxy Layer (Nginx/HAProxy)**
   - What paths are cached?
   - How is cache key constructed?
   - What's the cache TTL?

3. **CDN Layer (Cloudflare/CloudFront)**
   - Page rules / cache behaviors
   - Origin cache settings
   - Cache key configuration

### Command to Check Full Stack

```bash
# Find all config files
find . -name "*.conf" -o -name "*.vcl" -o -name "nginx*" -o -name "*cloudfront*" -o -name "*cdn*" 2>/dev/null | head -20

# Check for cache configuration across all layers
grep -rniE "cache|proxy_cache|vcl_|CDN|cloudfront|cloudflare" --include="*.conf" --include="*.vcl" --include="*.json" --include="*.yaml" --include="*.tf"
```

---

## Exploitation Checklist

When cache vulnerabilities are found:

- [ ] Identify what content can be cached
- [ ] Determine if authenticated responses are cacheable
- [ ] Find a way to make victim visit poisoned URL
- [ ] Check cache TTL to understand exploitation window
- [ ] Verify cache key doesn't include session identifiers
- [ ] Test path extension abuse (add `.css`, `.png`, `.js`)
- [ ] Check for unkeyed headers that affect response

---

## Example Attack Scenarios

### Scenario 1: SSRF + Cache Deception (CDNio Pattern)

```
1. SSRF allows bot to visit internal URLs as admin
2. Nginx caches /*.png for 3 minutes
3. Make bot visit /profile.png (admin profile)
4. Request /profile.png → Get cached admin data
```

### Scenario 2: Path Confusion

```
1. App serves /api/user regardless of extension
2. CDN caches /api/user.css (thinks it's static)
3. Attacker requests /api/user.css
4. Gets user profile from cache
```

### Scenario 3: Host Header Poisoning

```
1. Cache key includes Host header
2. Inject X-Forwarded-Host: evil.com
3. Response contains evil.com URLs
4. Cache serves poisoned response to all users
```

---

## Remediation

### Nginx

```nginx
# Don't cache authenticated responses
location ~* \.(css|js|png|jpg)$ {
    proxy_cache cache;
    proxy_cache_valid 200 3m;
    # Add this to prevent caching authenticated responses
    proxy_cache_bypass $http_authorization $cookie_session;
    proxy_no_cache $http_authorization $cookie_session;
}
```

### Application

```python
# Set proper cache headers for authenticated endpoints
@app.route('/profile')
@jwt_required
def profile():
    response = make_response(jsonify(user_data))
    response.headers['Cache-Control'] = 'private, no-store'
    response.headers['Vary'] = 'Authorization'
    return response
```

### CDN

- Include Authorization/Cookie in cache key
- Use "Cache-Control: private" for authenticated content
- Set appropriate cache behaviors per path pattern

---

## CWE References

| CWE | Name | Example |
|-----|------|---------|
| CWE-524 | Sensitive Info in Cache | Authenticated data cached |
| CWE-525 | Browser Cache Sensitive Info | Secrets in browser cache |
| CWE-444 | HTTP Request Smuggling | Cache poisoning via smuggling |
| CWE-436 | Interpretation Conflict | Path extension confusion |