hunt-cache-poison

Web cache deception occurs when cache rules expose authenticated user data. You detect it by hunting for misconfigured Vary rules and cache-key misconfigurations across both authenticated and unauthenticated endpoints in CDN-backed apps, measuring the blast radius of exposed data.

Web cache deception exposes sensitive authenticated data by exploiting misconfigured CDN cache rules. It impacts authenticated endpoints by allowing unauthorized access to private content through cache-key manipulation, leading to widespread data leakage across edge caches.

Cache poisoning testing works on multi-tenant CDN setups where cache keys may be influenced by unkeyed headers or misconfigured Vary rules. It applies to both authenticated and unauthenticated endpoints across content delivery networks to identify exploitable cache entries.

You verify the blast radius of web cache poisoning by performing independent validation. After injecting controlled headers to poison a cache entry, query the targeted URL from a separate client to confirm the cache-wide impact and reproduction of the poisoned response.

You should avoid testing unkeyed header reflections without proper authorization, as reproducing poisoned cache entries can cause automated denial of service and page integrity issues across edge caches. Ensure safe testing using abstracted payloads and authorized test targets.