QID 150632

Date Published: 2023-03-10

QID 150632: Web Cache Deception

Web Cache Deception (WCD) is an attack in which an attacker deceives a caching proxy into improperly storing private information sent over the internet and gaining unauthorized access to that cached data.

When the browser makes a request to a website, the connection usually passes through the CDNs (Content Delivery Network). CDNs are a geographically distributed network of proxy servers and their data centers, which caches the local copies of web content to provide faster access to the users by reducing their network latency, and thus reducing the load on web servers.

Caching servers have no safeguards to authenticate users and prevent information, and it only stores non-user specific static or public content. And all the user-specific dynamic contents get routed to the main servers of the website or service a user interacts with.

The web caching deception (WCD) attack works by the technique of path confusion attack. It manipulates the URL path by which the cache server is forced to store, and the sensitive data gets revealed as public content.

The WAS scanning engine detects the WCD vulnerability using the following steps:

An unauthenticated deception request is sent to the link that requires authentication for e.g. https://www.example.com/auth/vuln.jsp/test.css.

The response is compared with authenticated response of https://www.example.com/auth/vuln.jsp.

If the responses are similar, WAS scan will confirm that Web Cache Deception Vulnerability exists.

If web cache deception vulnerability exists, an attacker can force the sensitive data into the cache. This data can then be accessed and exploited by the attacker. The mechanism closely resembles cache poisoning that instead pollutes the cache with an exploit payload.

CVSS V3 rated as High - 8 severity.

CVSS V2 rated as Critical - 8.5 severity.

Solution

The following are the most opted mitigation methodologies: 1. The cache server should run based on the cache-control headers set by your application, and only cache the files if their HTTP caching headers allow it. 2. Cache the files only depending upon their Content-Type header, rather than solely checking the file extensions. 3. The server should return HTTP-errors such as 302, or 404 based on the non-existent files being requested.

Vendor References

CVEs related to QID 150632

Software Advisories

Advisory ID	Software	Component	Link

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].