search

Cache Poisoning to DoS

In this page you can find different variations to try to make the web server respond with errors to requests that are valid for the cache servers

  • HTTP Header Oversize (HHO)

Send a request with a header size larger than the one supported by the web server but smaller than the one supported by the cache server. The web server will respond with a 400 response which might be cached:

GET / HTTP/1.1
Host: redacted.com
X-Oversize-Hedear:Big-Value-000000000000000

  • HTTP Meta Character (HMC) & Unexpected values

Send a header that contain some harmfull meta characters such as and . In order the attack to work you must bypass the cache first.

GET / HTTP/1.1
Host: redacted.com
X-Meta-Hedear:Bad Chars\n \r

A badly configured header could be just \: as a header.

This could also work if unexpected values are sent, like an unexpected Content-Type:

GET /anas/repos HTTP/2
Host: redacted.com
Content-Type: HelloWorld

  • Unkeyed header

Some websites will return an error status code if they see some specific headers in the request like with the X-Amz-Website-Location-Redirect: someThing header:

GET /app.js HTTP/2
Host: redacted.com
X-Amz-Website-Location-Redirect: someThing

HTTP/2 403 Forbidden
Cache: hit

Invalid Header

  • HTTP Method Override Attack (HMO)

If the server supports changing the HTTP method with headers such as X-HTTP-Method-Override, X-HTTP-Method or X-Method-Override. It's possible to request a valid page changing the method so the server doesn't supports it so a bad response gets cached:

  • Unkeyed Port

If port in the Host header is reflected in the response and not included in the cache key, it's possible to redirect it to an unused port:

  • Long Redirect DoS

Like in the following example, x is not being cached, so an attacker could abuse the redirect response behaviour to make the redirect send a URL so big that it returns an error. Then, people trying to access the URL without the uncached x key will get the error response:

  • Host header case normalization

The host header should be case insensitive but some websites expect it to be lowercase returning an error if it's not:

  • Path normalization

Some pages will return error codes sending data URLencode in the path, however, the cache server with URLdecode the path and store the response for the URLdecoded path:

  • Fat Get

Some cache servers, like Cloudflare, or web servers, stops GET requests with a body, so this could be abused to cache a invalid response:

hashtag
Referencesarrow-up-right

PreviousCache Poisoning via URL discrepanciesNextClickjacking

Last updated