Francesco Minetti - A Methodology for Web Cache Deception Vulnerability discovery

Francesco Minetti presents a comprehensive methodology for discovering web cache deception (WCD) vulnerabilities, combining research, bug bounty findings, and an automated detection tool. The talk establishes that web caching, introduced to reduce HTTP traffic and improve performance, exists in approximately 90% of modern web applications but can be exploited when discrepancies arise between how origin servers parse request paths and how intermediary nodes (CDNs, reverse proxies) cache resources based on configured cache keys.

Minetti traces WCD research history from Omer Gill's 2017 discovery through academic papers (2020, 2022, 2024) showing attacks via path delimiters (semicolons, question marks, encoded characters, path traversal sequences). The core attack sends victims malicious links combining existing resources with fake static file extensions (e.g., /account.php/nonexistent.js); when victims click, their authenticated requests cause servers to cache sensitive data, which attackers later retrieve unauthenticated.

Minetti details previously undocumented edge cases from his bug bounty work: (1) WCD without cache headers in responses; (2) sensitive data in cached HTML including session cookies and JWT tokens (one case netted $20,000 bounty when homepage cached another user's JWT); (3) cookie-dependent cache keys where identical cookies are required for cache retrieval; (4) dynamically modified cached content (e.g., Cloudflare email obfuscation); (5) CSRF token theft combined with cache deception, demonstrated via Magento e-commerce vulnerability. He also documented zero-click attacks via email clients that auto-load external images, triggering cache deception without user interaction when proper conditions exist (no state-partitioned cookies, unfiltered media in email bodies, same-site cookies set to None).

To automate detection, Minetti created WCD Probe (open-sourced), a Java/Maven tool using Selenium for crawling and browser extensions for authentication. Unlike prior tools that only check cache headers (producing false positives), WCD Probe validates actual cached content against configured markers (usernames, emails, phone numbers, cookies, CSRF tokens) to confirm vulnerabilities. Testing on 100 domains with sensitive HTML content found 13 vulnerable sites across reverse proxies, CDNs, and local caches (Magento). Limitations include vulnerability to anti-bot software and JavaScript webdriver detection.

Key technical insights: cache keys may include path, query string, cookies, and headers; response codes beyond 200 get cached (404, 410, etc.); double-encoded delimiters bypass some filters; attack surface is all HTML links in target applications. Minetti emphasizes that historical conditions (pre-2023, before partitioned storage and same-site cookies) made this vulnerability especially dangerous, and modern variants via blog comments with arbitrary paths remain exploitable. He thanks Akamai, University of Milan, and collaborators for this research effort.