Cache Poisoning at Scale

#1

Post by arkadiyt » Thu, Dec 23, 2021, 12:16 AM UTC

Re: Cache Poisoning at Scale

#2

Post by throwaway984393 » Thu, Dec 23, 2021, 1:18 AM UTC

Jesus Christ, this is massive! Props to Youstin, great work. This is the kind of stuff that keeps people on the internet safe from major attacks with fancy names. I hope he got his bounties!

Re: Cache Poisoning at Scale

#3

Post by criticaltinker » Thu, Dec 23, 2021, 3:43 AM UTC

> Since both hosts were behind the same loadbalancer, it was possible to cache files hosted on redacted-cdn.com under assets.redacted.com, inherently allowing me to move the vulnerable html file on a different domain and achieve xss under a different origin.

Oof that Fastly XSS seems particularly nasty, and no mention of the bounty.

Am I understanding correctly that any website hosted on Fastly was vulnerable to XSS because of this?

Re: Cache Poisoning at Scale

#4

Post by maxim_b » Thu, Dec 23, 2021, 11:24 AM UTC

Seems like he was rewarded a total of $24,150 for all bounties together.

I'm not experienced with bug bounty programs but while that is a nice payday it still seems rather low for the severity of the bugs.

Re: Cache Poisoning at Scale

#5

Post by wdb » Thu, Dec 23, 2021, 11:45 AM UTC

Great read, helped me understand cache poisoning better :)

Re: Cache Poisoning at Scale

#6

Post by tyingq » Thu, Dec 23, 2021, 2:36 PM UTC

>Moreover, ATS generates cache keys by extracting the host, path and query, ignoring the url fragment.

Seems like this should note that browsers don't send the url fragment in the request. It's solely used browser-side. That's why it shouldn't forward the fragment on.