Cache Key Injection - Smuggling Poison Through the Door

The talk opens with a primer on how reverse proxies such as Nginx build a cache key from request fragments like scheme, host, path, query and selected headers. Most cache poisoning research targets unkeyed inputs, but this talk focuses on the key itself. When a configuration folds a header or cookie into the key, an attacker who controls that value can shift text between fragments and produce the same key with a different meaning.

The talk walks through several impacts. In one case, a path blocked by an access rule never reaches the cache, so splitting the key lets an unprivileged request reuse a response cached from a local admin request. Another case stores an error page under a homepage key, causing denial of service for ordinary users. Cache deception without user interaction is also shown, along with stored XSS built from host header reflection and identical responses on ports 80 and 443. The speaker notes that a CDN layer can be bypassed to reach the origin cache directly.

For defenders, the takeaway is to detect injection by probing fragment boundaries and to harden keys by hashing each fragment separately before combining them into one final hash. The speaker reports that Varnish resisted these attacks, and argues that this area still deserves much more research.