[Paper Review] Cached and Confused: Web Cache Deception in the Wild

Seyed Ali Mirheidari, Sajjad Arshad+4 more|arXiv (Cornell University)|Dec 21, 2019

Spam and Phishing Detection19 references4 citations

TL;DR

This paper presents the first large-scale empirical study of Web Cache Deception (WCD) in production environments, revealing that 295 out of 340 high-profile sites in the Alexa Top 5K remain vulnerable to WCD two years after its public disclosure. The study demonstrates that WCD can leak private user data and steal sensitive authentication tokens, enabling full account takeovers, and shows that WCD is a systemic issue rooted in path confusion between origin servers and caches, not isolated misconfigurations.

ABSTRACT

Web cache deception (WCD) is an attack proposed in 2017, where an attacker tricks a caching proxy into erroneously storing private information transmitted over the Internet and subsequently gains unauthorized access to that cached data. Due to the widespread use of web caches and, in particular, the use of massive networks of caching proxies deployed by content distribution network (CDN) providers as a critical component of the Internet, WCD puts a substantial population of Internet users at risk. We present the first large-scale study that quantifies the prevalence of WCD in 340 high-profile sites among the Alexa Top 5K. Our analysis reveals WCD vulnerabilities that leak private user data as well as secret authentication and authorization tokens that can be leveraged by an attacker to mount damaging web application attacks. Furthermore, we explore WCD in a scientific framework as an instance of the path confusion class of attacks, and demonstrate that variations on the path confusion technique used make it possible to exploit sites that are otherwise not impacted by the original attack. Our findings show that many popular sites remain vulnerable two years after the public disclosure of WCD. Our empirical experiments with popular CDN providers underline the fact that web caches are not plug & play technologies. In order to mitigate WCD, site operators must adopt a holistic view of their web infrastructure and carefully configure cache settings appropriate for their applications.

Motivation & Objective

• To quantify the real-world prevalence of Web Cache Deception (WCD) vulnerabilities across high-traffic websites.
• To investigate the security implications of WCD beyond simple PII leakage, including the exposure of secret authentication and authorization tokens.
• To analyze how path confusion techniques can be extended to exploit sites not vulnerable to the original WCD variant.
• To evaluate the effectiveness of CDN providers’ default caching configurations and mitigation strategies in preventing WCD.
• To highlight the systemic nature of WCD as a safety problem arising from interactions between components, not individual misconfigurations.

Proposed method

• Developed an automated, scalable methodology to detect WCD vulnerabilities in live websites by analyzing cache behavior across multiple request patterns.
• Used path confusion techniques to test whether a cache stores non-cacheable responses by manipulating URL path components in a way that confuses the cache's key generation logic.
• Conducted large-scale scanning across 340 sites from the Alexa Top 5K to identify WCD vulnerabilities in production environments.
• Performed empirical analysis of popular CDN providers’ default caching behaviors and configuration mechanisms to assess their resilience to WCD.
• Collected and analyzed leaked data from vulnerable sites, including PII and session tokens, to assess real-world impact.
• Extended the original WCD attack surface by exploring variations in path confusion that bypass traditional detection and mitigation mechanisms.

Experimental results

Research questions

• RQ1 How prevalent is Web Cache Deception (WCD) in real-world, high-traffic websites among the Alexa Top 5K?
• RQ2 What types of sensitive data—beyond PII—are leaked via WCD, and how can they be exploited in practice?
• RQ3 Can path confusion techniques be extended to exploit sites that are not vulnerable to the original WCD variant?
• RQ4 Why do WCD vulnerabilities persist in production environments despite public disclosure and vendor advisories?
• RQ5 To what extent do CDN providers’ default configurations and customization options mitigate or exacerbate WCD risks?

Key findings

• 295 out of 340 high-profile sites in the Alexa Top 5K were found to be vulnerable to Web Cache Deception, indicating widespread exposure.
• WCD vulnerabilities were found to leak not only private user information (PII) but also secret authentication and authorization tokens, enabling full account compromise.
• In a follow-up measurement 14 months after the initial scan, 25 WCD vulnerabilities were identified across 340 sites, with only 12 of 16 previously vulnerable sites having mitigated the issue.
• The study demonstrated that variations of path confusion can exploit sites that are not vulnerable to the original WCD technique, expanding the attack surface.
• CDN providers’ default caching behaviors were found to be insufficient to prevent WCD, and site operators must adopt a holistic, system-level configuration strategy.
• The persistence of WCD vulnerabilities highlights a systemic security problem: no single component is at fault, but interactions between origin servers, proxies, and caches create exploitable edge cases.