Monday, February 27, 2017

Web Cache Deception Attack

Did it ever cross your mind that accessing links such as or might expose your sensitive data, and even allow attackers to take control over your account?
Web cache deception is a new web attack vector that puts various technologies and frameworks at risk.

A few words about caching and reactions

1. Websites often tend to use web cache functionality (for example over a CDN, a load balancer, or simply a reverse proxy). The purpose is simple: store files that are often retrieved, to reduce latency from the web server.
Let's see an example of web cache. Website is configured to go through a reverse proxy. A dynamic page that is stored on the server and returns personal content of users, such as, will have to create it dynamically per user, since the data is different for each user. This kind of data, or at least its personalized parts, isn't cached.
What's more reasonable and common to cache are static, public files: style sheets (css), scripts (js), text files (txt), images (png, bmp, gif), etc. This makes sense because these files usually don't contain any sensitive information. In addition, as can be found in various best practices articles about web cache configuration, it's recommended to cache all static files that are meant to be public, and disregard their HTTP caching headers.

2. The web cache deception attack counts on similar browsers' and web servers' reactions, in the same way as the RPO attack, explained in and
What happens when accessing a URL like
A GET request to that URL will be produced by the browser. The interesting thing is the server's reaction – how does it interpret the request URL? Depending on its technology and configuration (the URL structure might need to be built slightly different for different servers), the server returns the content of And yes, the URL remains The HTTP headers will be the same as for accessing directly: same caching headers and same content type (text/html, in this case).

Done with the introduction

What happens if we access, while web cache for static files is set on the proxy server, disregarding caching headers for this kind of file? Let's analyze this process:
  1. Browser requests
  2. Server returns the content of, most probably with HTTP caching headers that instruct to not cache this page.
  3. The response goes through the proxy.
  4. The proxy identifies that the file has a css extension.
  5. Under the cache directory, the proxy creates a directory named home.php, and caches the imposter "CSS" file (non-existent.css) inside.


Taking advantage of it

An attacker who lures a logged-on user to access will cause this page – containing the user's personal content – to be cached and thus publicly-accessible. It could get even worse, if the body of the response contains (for some reason) the session identifier, security answers or CSRF tokens. All the attacker has to do now is to access this page on his own and expose this data.

An anecdote

Usually websites don't require authentication to access their public static files. Therefore, the cached files are publicly-accessible – no authentication required.


So basically, two conditions are required for this vulnerability to exist:
  1. Web cache functionality is set for the web application to cache files by their extensions, disregarding any caching header.
  2. When accessing a page like, the web server will return the content of "home.php" for that URL.


  1. Configure the cache mechanism to cache files only if their HTTP caching headers allow. That will solve the root cause of this issue.
  2. If the cache component provides the option, configure it to cache files by their content type.
  3. Configure the web server so that for pages such as, the web server doesn’t return the content of "home.php" with this URL. Instead, for example, the server should respond with a 404 or 302 response.

Web Cache Deception in PayPal – PII Exposure

PayPal was vulnerable to web cache deception. The vulnerability is now fixed and was publicly disclosed.

Information that could be leaked by exploiting this vulnerability:
- Users' first & last names
- Account balance
- Last four credit card digits
- Transactions data
- Full passport number
- Email address
- Home address
- Phone number
- Any additional information included in vulnerable pages

Examples for some of the vulnerable pages:

Various static file extensions could be used to cache pages on PayPal (more than 40). Among them:
aif, aiff, au, avi, bin, bmp, cab, carb, cct, cdf, class, css, doc, dcr, dtd, gcf, gff, gif, grv, hdml, hqx, ico, ini, jpeg, jpg, js, mov, mp3, nc, pct, ppc, pws, swa, swf, txt, vbs, w32, wav, wbmp, wml, wmlc, wmls, wmlsc, xsd, zip

Caching expiration
I've measured the time taken for the cached files to expire. It seems that after being accessed once (for the first time), a file is cached for ~5 hours. If it's accessed again during that time, the expiration time is extended. It's clear that this time period is more than enough for an attacker to "catch" the cached file on time before it expires, and by constantly monitoring this URL he can expose it as it's created.


Home page:

Settings page:

PayPal rewarded me with $3,000 for reporting this vulnerability.

User Hijacking via Web Cache Deception

I found this vulnerability in additional applications, which unfortunately cannot be disclosed to the public for different reasons (bummer, had some nice videos for that). In these applications, it was possible to take complete control over application users. This was possible because the session ID or security answers to recover a user's password were included in the HTML code of vulnerable pages. Big thanks to Sagi Cohen for the assistance.

IIS Demo

In the video below, a website is hosted on two web servers behind an IIS load balancer with Application Request Routing (ARR) installed.
A successful login redirects the users to the 'welcome.php' page, which contains their personal content. The load balancer is configured to cache all CSS files, and to disregard their caching headers.
An authenticated user accesses The IIS load balancer refers to the 'welcome.php' page as a directory, creates it in the cache directory, and caches 'stylsheet.css', which contains the user's private content.


  1. In the PayPal scenario, how did the proxy server even see the resources? Was it configured to do HTTPS interception and the client was configured to trust a dummy root certificate?

  2. I guess the connection between the Client and the Proxy-Server is either HTTP or HTTPS. However, in order to cache the content, the connection between the Proxy-Server and the Web-Server must be HTTP. I was curious about this as well and it looks like you can build this kind of architecture with Pound (SSL-Wrapper and Reverse Proxy) which forwards decrypted HTTPS requests to a caching server (e.g. Varnish). Please correct me if explained anything wrong.

  3. Nice vulnerability and well explained.

  4. That's a great finding. Thank you for writing this blog post.

  5. Great explanation, thanks for sharing

  6. Great post. can I translate it on my blog?

  7. Awesome attack. A Burp Extender is now available to make it easier to perform this attack:

  8. I am trying to create a PoC on Web Cache Deception attack using apache as origin server and nginx as reverse proxy.
    As I see, by default nginx obeys cache-control headers sent from origin server.
    Therefore, inorder to create the PoC I have to make specific configurations to ignore the origin server's headers.

    I don't understand why would any one force the caching of static file extensions?
    In nginx, if you just set a rule to cache static files (like .jpg) and then hit the attack URL say, even if the origin server sends the personal.php content, it also sends the related cache-control headers as you yourself have said.
    I have verified that these headers will be obeyed by nginx by default.
    Then that means for the Web Cache deception attack to be successful, the one doing the configuration has to have real low grade knowledge or may be he intentionally wants to let sensitive pages get cached.

    I understand the possibility of this attack in Akamai due to its Edge-Control header. But why the hell would any one set cache-control: no-cache, no-store headers for the static content like .jpg in the origin server and then try to overwrite it using the Edge-Control in reverse-proxy? Isn't it extra work?

  9. Hire Kolkata and Hyderabad escorts Girls for they are so busty at home when they are alone with you. You will find sexy being up coming at them. They will tell you very dirty talk that will encourage to love the Escorts in Kolkata and Hyderabad for sex pleasures.
    Visit the website to booked the best of your choice.
    Escorts Service in Kolkata
    Today Nights
    Escorts Service in Hyderabad

  10. Pakistan escorts
    Call girls in isb
    Escorts in isb
    Escorts in Lahore
    Lahore escorts
    Lahore Escort agency provides the best Escorts in Lahore plus Top Call Girls for Escort Dating & VIP Female Escorts in Lahore

  11. Kartik Web Technology is one of the most leading IT Service provider company which is listed in Gurgaon. Gurgaon is now big IT sector where lots of famous companies are located. If you want to grow your business at higher level then you need a good website to represent your self in the Marketing. Hire us to design your company's website. We will convert your all mind imagination into reality. Give us chance to serve our services.

    Web designing company

  12. This comment has been removed by the author.

  13. This comment has been removed by the author.


  14. 🦋 Escorts service in
    pakistani Lahore ✅ 🔴
    Escorts in Lahore is the best key word to search call girls in Lahore
    we serve best and VIP escorts in Islamabad also.💯
    Vip best real escorts service provider miss honey +92 323 3333153 call now 📞,🌟

    Hello 🍀 Vip call girls in lahore
    my name is Miss Leena I am from Lahore I give you best ever Escorts Service in Lahore. I have many more new girls for you in your town (Pakistan) I not avalible only in Lahore I give you Escorts service in Lahore, Karachi Islamabad and Murree. I (Miss Leena) give you 100 scure and safe Sex in Lahore, College and school going girls also give you best service on the bed and off the bed also. I work in Lahore for last 6 years.
    Only I have top calss escorts service.🌟 miss leena +92 305 3777077 call now 📞,🍀

  15. Showbiz Dating agency is one of the largest high-class independent Lahore Escorts providers. This city is growing rapidly to become an important commercial center in Pakistan +923212777792. So many businessmen are doing a lot of business in here for the reason that Lahore is a very famous and ancient of Pakistan. You will be impressed by the most excellent collection of Escorts in Lahore for your joy and satisfaction. You can get any type of female Escort if you are fond of Model Escort or Young call us now.