This document discusses web cache deception techniques that can be used to exploit vulnerabilities in how web caches handle URLs. It begins with background on web caching and the concept of path confusion. It then explains basic and advanced techniques for web cache deception, including using URL encoding, and discusses observations like bypassing CSRF protections and hijacking sessions. The document concludes that correctly configuring caches is challenging, as complex interactions between technologies can be exploited in unintended ways, and variations of these techniques increase the number of vulnerable sites.

1. Cached and Confused
Web Cache Deception in the Wild
Seyed Ali Mirheidari
Sajjad “JJ” Arshad
2020

2. @sajjadium

3. Agenda
➔ Background
➔ Path Confusion
➔ Web Cache Deception (WCD)
➔ Advanced Exploitation Techniques
➔ Notable Observations
➔ Lesson Learned
3Ali & JJ

4. Web Cache Technologies
4Ali & JJ
Browser CDN Proxy Server

5. Web Cache Behavior
5
Cache-Control Response Header
Cache-Control: no-store => Response should not be stored
Cache headers CAN be ignored by CDNs
Caching based on resource paths and extensions (e.g., jpg, css, js)
Ali & JJ

6. scheme://user:password@host:port/path?query#fragment
path => file like structure separated by / (e.g., account/index.php)
query => list of key/value separated by & (e.g., p1=v1&p2=v2)
fragment => arbitrary string (e.g., comment)
6Ali & JJ
URL 101

7. Traditional URL
https://example.com/account/index.php?p1=v1
Clean URL
https://example.com/account/v1
7Ali & JJ
Traditional vs Clean URL

8. https://example.com/account/id
Browser, CDN, and Proxy think account is a directory and id is a file on
the server’s filesystem
BUT
Server knows /account is referencing index.php file in the account
directory and id is a parameter to index.php
8Ali & JJ
Path Confusion 101

9. Path Confusion 201
9
Semantic Disconnect among different framework-independent web
technologies (e.g., browser, CDN, proxy, server) which results in
different URL path interpretations
Ali & JJ

10. Basic Path Confusion (with Path Parameter)
example.com/account.php
example.com/account.php/nonexistent.jpg
10Ali & JJ

11. 11Ali & JJ
Basic Web Cache Deception

12. Advanced Path Confusion
The Era of Encoding
12Ali & JJ

13. URL Encoding
13
A technique to embed special/non-ascii characters in URL
n => %0A ; => %3B # => %23 ? => %3F
Browsers & Proxies & CDNs & Servers can get confused with
customized encoding
Ali & JJ

14. Path Confusion with Encoded ?
example.com/account.php?name=val
example.com/account.php%3Fname=valnonexistent.css
14Ali & JJ

15. Path Confusion with Encoded n
example.com/account.php
example.com/account.php%0Anonexistent.css
15Ali & JJ

16. Path Confusion with Encoded ;
example.com/account.jsp;param
example.com/account.jsp%3Bparamnonexistent.css
16Ali & JJ

17. Path Confusion with Encoded #
example.com/account.php#frag
example.com/account.php%23nonexistent.css
17Ali & JJ

18. Effectiveness of Encoding
Out of 37 vulnerable sites, 25 were exploited by basic WCD
11 sites were exploited ONLY by advanced WCD techniques
Increased number of vulnerable sites by ~ 45%
Interestingly, there were sites ONLY exploited with ONE technique
URL encoding is quite effective to confuse CDNs and Proxies
Path confusion elicit significantly more 200 OK server response !
18Ali & JJ

19. Notable Observations
19Ali & JJ

20. ● PII (User, Name, Email, Phone, etc.)
● CSRF Tokens CSRF Protection Bypass
● OAuth State parameter OAuth Redirect URI CSRF
● Session ID/BREAR Token/API Key Session Hijacking
● Dynamic JavaScript file name Cross-Site Script Inclusion
(XSSI)
Practical Attack Scenarios
20Ali & JJ

21. Authenticated vs. Unauthenticated Attacker
WCD DOES NOT require attackers to be authenticated
Increase likelihood of WCD attack
Websites with no public registration can be targeted
21Ali & JJ

22. Cache Location
22Ali & JJ
Attack is possible cross-continent
6 sites were vulnerable!

23. Cache Expiration
23Ali & JJ
Attack is still possible after several hours
16 10 9
No. of vulnerable sites

24. Cache Configuration
24Ali & JJ
CDN Default Cached Objects
Honor Headers?
no-store no-cache private
Akamai Objects with a predefined list of static file extensions only. No No No
Cloudflare
Objects with a predefined list of static file extensions, AND all
objects with cache control headers public or max-age > 0.
Yes Yes Yes
CloudFront All objects. Yes Yes Yes
Fastly All objects. No No Yes

25. Lesson Learned
● Configuring web caches correctly is not trivial
● CDNs are not plug & play solutions
● There is a widespread lack of user awareness about WCD
● WCD is generally a “system safety” problem
○ No isolated faulty components
○ Complex interactions among web technologies must take into consideration
● Variations of path confusion techniques make it possible to
exploit sites that are otherwise not impacted by original attack
○ Some sites were only exploitable with one specific encoding attack
● Path confusion can be used in other attack vectors
○ Relative Path Overwrite (RPO), Cache Poisoning, CPDoS, ...
25Ali & JJ

26. Thanks! Questions?
Seyed Ali Mirheidari
Sajjad “JJ” Arshad
@sajjadium sajjadium
Ali & JJ
2020
26