Home / Series / DEF CON / Aired Order / Season 32 / Episode 49

Gotta Cache ‘em all: bending the rules of web cache exploitation

In recent years, web cache attacks have become a popular way to steal sensitive data, deface websites, and deliver exploits. We've also seen parser inconsistencies causing critical vulnerabilities like HTTP Request Smuggling. This raises the question: what happens if we attack web caches' URL-parsers? In this session, I'll introduce two powerful new techniques that exploit RFC ambiguities to bypass the limitations of web cache deception and poisoning attacks. First, I'll introduce Static Path Deception, a novel technique to completely compromise the confidentiality of an application. I’ll illustrate this with a case study showing how such a breach can be replicated in environments like Nginx behind Cloudflare. Next, I'll present Cache Key Confusion, and show how to exploit URL parsing inconsistencies in major platforms, including Microsoft Azure Cloud. I’ll then show how to achieve arbitrary cache poisoning and full denial of service.

English
  • Originally Aired August 10, 2024
  • Runtime 45 minutes
  • Created August 25, 2024 by
    Subscriber-2473783
  • Modified August 25, 2024 by
    Subscriber-2473783