Web cache poisoning with multiple headers | Jan 23, 2023
Introduction
Welcome to my another writeup! In this Portswigger Labs lab, you’ll learn: Web cache poisoning with multiple headers! Without further ado, let’s dive in.
- Overall difficulty for me (From 1-10 stars): ★☆☆☆☆☆☆☆☆☆
Background
This lab contains a web cache poisoning vulnerability that is only exploitable when you use multiple headers to craft a malicious request. A user visits the home page roughly once a minute. To solve this lab, poison the cache with a response that executes alert(document.cookie) in the visitor’s browser.
Exploitation
Home page:
Burp Suite HTTP history:
In here, we see that the web application is using caches to cache the web content.
View source page:
<script type="text/javascript" src="/resources/js/tracking.js"></script>
In here, we see there is a JavaScript file is loaded:
document.write('<img src="/resources/images/tracker.gif?page=post">');
Which is a document.write sink (Dangerous function) that writes an <img> element to the web page.
Now, what if I change the scheme from HTTPS to HTTP?
To do so, we could use a HTTP header called X-Forwarded-Scheme:
As you can see, we’re redirecting to HTTPS scheme. So, the web application enforced a secure communication using HTTPS. To enforce this, if a request that uses another protocol is received, the website dynamically generates a redirect to itself that does use HTTPS.
Armed with above information, we can try to control the dynamically generated redirect link.
To do so, we could use X-Forwarded-Host HTTP header:
Nice! We can control the domain!
That being said, we can load any JavaScript file from any website!!
Now, we can load an evil JavaScript file from our exploit server, which has a JavaScript payload alert():
document.write('<script>alert(document.cookie)</script>');
Then host the payload on the exploit server:
After that, we can try to poison the cache:
Now, who ever visit the home page, they will loaded our evil JavaScript file:
Nice!
What we’ve learned:
- Web cache poisoning with multiple headers