Cache Deception Defense

Web caching mechanism

Web caching speeds up content delivery and reduces origin server load. When you use an edge security acceleration service such as ESA, edge nodes decide whether to cache client-requested resources (such as CSS, JavaScript, images, and other static or public files) based on preconfigured cache rules. After a resource is cached, subsequent requests for the same resource from the same region are served {{conref:t2595484.xdita#5ee251e92catc}} directly from the edge node, eliminating the need to fetch it from the origin server. This significantly reduces response time and improves user experience.

Attack principle

In a web cache deception attack, an attacker crafts a request URL that appears to reference a static, cacheable resource. For example, the attacker appends a static file extension such as .css or .jpg to a URL that serves dynamic, user-specific content. The attacker then tricks an authenticated user (the victim) into visiting the crafted URL. If the caching configuration does not verify that the actual content type matches the file extension, the cache stores the response, which contains the victim's private data. The attacker then requests the same URL to retrieve the cached sensitive information.

For example:

1. An attacker crafts the URL http://www.example.com/profile/account.css and tricks a victim into visiting it while the victim is authenticated.

2. The origin server returns the victim's account page content with content-type: text/html.

3. The cache, relying on the .css extension, incorrectly stores the response.

4. The attacker requests the same URL and retrieves the cached page, which contains the victim's private data.