Report ID
#34043
Report type
Websites and Applications
Has PoC?
Yes
Target
https://app.bean.money
Impacts
- Redirecting users to malicious websites
- Taking down the application/website requiring manual restoration
- Persistent content spoofing / text injection issues
Description
Cache poisoning is a type of cyber attack in which attackers insert fake information into a domain name system (DNS) cache or web cache for the purpose of harming users. In DNS cache poisoning or DNS spoofing, an attacker diverts traffic from a legitimate server to a malicious/dangerous server.
Vulnerability Details
These are the points of Cache Poisoning
- An attacker sends a simple HTTP request containing a malicious header targeting a victim resource provided by some web server. The request is processed by the intermediate cache, while the malicious header remains unobtrusive.
- The cache forwards the request to the origin server as it does not store a fresh copy of the targeted resource. At the origin server, the request processing provokes an error due to the malicious header it contains.
- As a consequence, the origin server returns an error page which gets stored by the cache instead of the requested resource.
- The attacker knows that the attack was successful when she retrieved an error page in response.
- Legitimate users trying to obtain the target resource with subsequent requests......will get the cached error page instead of the original content.
Impact Details
Actually if the scope is large, once the error page is injected, the CDN distributes it to many other edge cache server locations around the world. But here (in this case), the root cause is illegal character which is allowed inputed in header field.
References
- https://cpdos.org/
- https://book.hacktricks.xyz/pentesting-web/cache-deception
- https://portswigger.net/kb/issues/00200180_web-cache-poisoning
Proof of concept
Execute this request (under Host: app.bean.money, add ":1)
The response should be blank page