Loading story…
Researchers and bug bounty hunters have demonstrated advanced techniques for exploiting web cache poisoning vulnerabilities in web applications. These attacks leverage inconsistencies in how web servers and caching layers handle HTTP requests, particularly when parameters are excluded from cache keys or when GET requests with bodies are accepted. By manipulating request parameters and exploiting these discrepancies, attackers can poison cached responses, leading to the execution of arbitrary JavaScript in victim browsers and potential data leaks.
Specific labs and real-world scenarios illustrate how features intended for performance optimization, such as parameter cloaking and accepting non-standard HTTP requests, can inadvertently introduce critical security flaws. Tools like Burp Suite's Param Miner assist in identifying these vulnerabilities, and the research underscores the importance of understanding HTTP protocol intricacies for both attackers and defenders. The findings highlight the need for rigorous cache key management and consistent parameter parsing to prevent exploitation.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
An overview article highlighted web cache poisoning as a significant web attack class, emphasizing the dangers of improper cache key construction and inconsistent request handling. The piece served as a broader explanation of the attack pattern rather than a new incident disclosure.
A separate PortSwigger lab write-up described a cache poisoning flaw where the server accepted GET requests with a body but did not include the body in the cache key. By placing a malicious callback value in the request body, an attacker could poison a cached JavaScript resource and trigger script execution in victims' browsers.
A PortSwigger lab write-up documented a web cache poisoning issue caused by excluding the utm_content parameter from the cache key and inconsistent parsing between the cache and backend. The technique allowed an attacker to cloak a second parameter and poison cached responses with malicious JavaScript.
During routine mass reconnaissance using automated subdomain enumeration and endpoint discovery, a security researcher found a broken API route tied to a supposedly safe performance optimization feature that exposed sensitive production secrets. The finding showed how an optimization mechanism had introduced a critical data leak.
A zhero_web_security write-up described denial-of-service cache poisoning cases, including one on a Mozilla developer page where unkeyed inputs could trigger backend errors or cache a 404 response for other users. The article also noted Mozilla treated the reported DoS issue as out of scope for its bug bounty program.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
osintteam.blog
Open sourceosintteam.blog
Open sourceosintteam.blog
Open sourceinfosecwriteups.com
Open sourcezhero-web-sec.github.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers and enthusiasts have recently highlighted several web application vulnerabilities and exploitation techniques, focusing on real-world scenarios and educational walkthroughs. One write-up details a web challenge from the v1t CTF, where the key to exploitation was careful source code analysis rather than traditional attack vectors, emphasizing the importance of understanding application logic and default credential checks. Another article provides a step-by-step breakdown of a $6,000 bug bounty awarded for a persistent cross-site scripting (XSS) vulnerability on Yelp.com, explaining how the flaw allowed attackers to hijack user sessions and steal credentials, and offering practical advice for identifying similar bugs. Additionally, a technical walkthrough demonstrates how reflected XSS can be exploited in the DVWA (Damn Vulnerable Web Application) environment, illustrating the risks of improper input validation and script execution in browsers. A separate analysis explores a Cross-Origin Resource Sharing (CORS) misconfiguration involving a trusted "null" origin, showing how such errors can lead to sensitive data exposure across domains. These cases collectively underscore the ongoing risks posed by web application misconfigurations and the value of both offensive and defensive security research in identifying and mitigating these threats.
Jun 29, 2026
A security researcher discovered that a popular Content Delivery Network (CDN) was serving cached responses that exposed private user data at scale. By conducting mass reconnaissance and analyzing cache behaviors, the researcher identified that the CDN was returning sensitive information to unauthorized users due to improper cache controls and response header misconfigurations. This vulnerability allowed attackers to access confidential data simply by refreshing pages or manipulating request headers, highlighting the risks of relying on default CDN settings for sensitive web applications. In a separate incident, another researcher found that a web application's admin dashboard was accessible without any hacking or exploitation, due to exposed APIs and missing authorization checks. By identifying an API subdomain with publicly available documentation, the researcher was able to chain together several misconfigurations, escalating privileges from a normal visitor to full administrator access. Both cases underscore the critical importance of proper configuration and access controls in web infrastructure, as seemingly minor oversights can lead to significant data exposure and privilege escalation risks.
Jul 12, 2026
Multiple web application labs demonstrate how flawed access control mechanisms can be exploited to escalate privileges. In one scenario, method-based access control is circumvented by manipulating HTTP request methods, allowing a non-admin user to perform administrative actions. Another lab highlights the risks of relying on the `Referer` header for access control, showing that attackers can bypass restrictions by crafting requests with manipulated headers and session cookies. A third lab exposes a multi-step process vulnerability, where the absence of access control on a critical step enables unauthorized role changes by replaying requests with altered session data. These labs underscore the dangers of implementing weak or incomplete access control checks, particularly when relying on easily manipulated HTTP methods or headers. The demonstrations provide practical examples of how attackers can exploit such flaws using tools like Burp Suite to intercept and modify requests, emphasizing the need for robust, defense-in-depth access control strategies in web applications.
Jul 12, 2026