Vulnerability Details
Severity:
High
Category:
Web Application
Description
The application or its caching infrastructure can be manipulated to store and serve malicious content by poisoning cache entries through unkeyed request headers or parameters.
Risks
An attacker could serve malicious content to all users requesting the poisoned resource, enabling widespread XSS, redirects to phishing sites, or denial of service.
Remediation
Carefully review which headers and parameters are used as cache keys. Strip unrecognized headers before caching. Use Vary headers correctly. Implement cache key normalization and validation.