{"id":32337,"date":"2019-12-16T17:29:43","date_gmt":"2019-12-16T17:29:43","guid":{"rendered":"http:\/\/8f8cddbd-12e4-4b8b-ae52-4a41f3c896f7"},"modified":"2019-12-16T17:29:43","modified_gmt":"2019-12-16T17:29:43","slug":"web-cache-deception-attacks-still-impact-websites-with-substantial-user-populations","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/web-cache-deception-attacks-still-impact-websites-with-substantial-user-populations\/","title":{"rendered":"Web Cache Deception attacks still impact websites with ‘substantial user populations’"},"content":{"rendered":"

\"global-tech-connectivity-mobility-istock.jpg\"<\/span><\/p>\n

Connection lines Around Earth Globe, Futuristic Technology Theme Background with Light Effect<\/span><\/p>\n

Getty Images\/iStockphoto<\/span> <\/p>\n

Almost two years after first being documented, Web Cache Deception attacks are still a major issue, and they still impact many popular websites.<\/p>\n

New academic research published this month reveals that 25 of the Alexa Top 5,000 websites are still impacted by Web Cache Deception (WCD) attacks.<\/p>\n

While the number is small, academics say these websites have “substantial user populations,” allowing attackers to retrieve personal user information from a user’s account without having to authenticate.<\/p>\n

What is a Web Cache Deception attack<\/h3>\n

Web Cache Deception attacks were first disclosed in February 2017. They were discovered by Omer Gil<\/a>, a security researcher, and bug hunter.<\/p>\n

Gil found that many of today’s popular websites would cache pages that contained a user’s personal information. These cached pages would be stored inside a website’s front-facing content delivery network (CDN), readily available to anyone on the internet, effectively bypassing login requirements.<\/p>\n

Cached sensitive content included backend dashboards, settings sections, pages with financial details, etc. — pages usually exempt from a website’s caching procedures.<\/p>\n

The trick, Gil said, was for an attacker to convince a user to access a boobytrapped URL that had the following structure: [LEGITIMATE_DASHBOARD_URL]\/[NON-EXISTENT_FILE]<\/p>\n

\n<\/section>\n

An example would be:<\/p>\n

https:\/\/www.paypal.com\/myaccount\/home\/blablablabla.css<\/strong><\/em><\/p>\n

If the user clicked and accessed one of these booby-trapped links, a website’s CDN would cache the user’s personal dashboard, along with all the data found inside, and store it on the website’s public, front-facing CDN server.<\/p>\n

An attacker would only have to access the original boobytrapped URL and retrieve that particular user’s dashboard content.<\/p>\n

\"wcd-attack.png\"<\/span>

\"wcd-attack.png\"<\/span><\/p>\n

<\/noscript> Image: Mirheidari et al.<\/span><\/p>\n

\n