Other nomination

Caching the Un-cacheables - Abusing URL Parser Confusions

URL parser confusion between a CDN and its origin: the caching front end normalises dot segments in a path while the backend does not, so a request to /Job/../Award/x is served by the vulnerable /Job/ handler but cached under the cacheable /Award/ prefix. This converts a cookie and header only self-XSS into stored XSS served to every visitor.

Record

Published by

Harel Security Research

Date

2 September 2022

In the archive

• Nominated for the 2022 Top 10 Web Hacking Techniques

Tags

• cache-poisoning
• parser-differential
• xss
• url-parsing
• waf-bypass
• cdn
• cache
• attack-chain
• bug-bounty
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Harel Security Research, first published at the original source. Preserved copies are kept so the citation survives its host.