New Cache Deception Exploit Circumvents Cache-Server Mismatch

A newly documented cache deception attack exploits subtle discrepancies between caching layers and origin servers to expose sensitive endpoints and deliver malicious payloads.

By leveraging path normalization divergences and unconventional delimiters, attackers can trick content delivery networks (CDNs) into caching unauthorized responses while the backend interprets requests differently.

This technique amplifies the impact of web cache deception, enabling unauthorized data exposure and persistent poisoning of shared caches.

Modern CDNs often apply aggressive caching to URLs that appear to reference static assets—files with extensions like .css, .js, .svg, or .xml.

Attackers can exploit this by appending bogus extensions or directory fragments to dynamic endpoints, causing the cache layer to store and serve sensitive pages. For example, sending a request to:

textGET /api/auth/session/test.css HTTP/2
Host: chat.openai.com

returns a valid CSS payload and is cached, whereas the identical endpoint without the .css extension results in a 400 error.

Caching rules keyed strictly on path prefixes under directories like /share/ can be subverted in the same way; any request beneath https://chat.openai.com/share/ is cached indiscriminately. This allows malicious actors to craft URLs such as:

texthttps://chat.openai.com/share/../api/auth/session?cachebuster=123

The CDN naïvely caches the resource because it assumes the request targets a shareable asset, while the origin server—after decoding %2f and normalizing—serves the protected session information.

Cache Deception Exploit

A critical enabler of this attack is the difference in how CDNs and backend servers handle path traversal and special delimiters.

CDNs may perform URL normalization—collapsing %2f into / and resolving .. segments—before mapping requests to cache entries, whereas the origin server might leave encoded characters intact or apply different routing rules.

To detect this, security researchers test cached static resources (e.g., /resources/js/stockCheck.js) by issuing:

textGET /aaa/..%2fassets/js/stockCheck.js HTTP/2

If the CDN treats this as the original static file and returns a cached hit, yet the backend cannot locate the decoded path, it indicates a discrepancy ripe for exploitation.

Attackers then search for delimiters understood by the backend but ignored or stripped by the cache—for instance, semicolons (;) in Java Spring’s matrix parameters.

Appending ;anything to a valid endpoint such as /my-account still yields the original page from both cache and server, but inserting a slash after the semicolon (/) forces the backend to treat the remainder as a separate path, leading to a 404 on dynamic endpoints.

Crafting the Final Payload

According to Report, By combining both techniques, attackers can construct a URL that appears to the cache as a harmless static resource while tricking the backend into serving a confidential page.

In a practical lab environment, the following payload successfully retrieves a protected robots.txt file—normally cached for 30 seconds under shared control—and forces the origin to disclose sensitive content:

textGET /my-account;%2f%2e%2e%2frobots.txt?wcdefe HTTP/2
Host: vulnerable-server.web-security-academy.net

Here’s how it works:

1. The cache server sees the path /my-account;/../robots.txt (after normalization) and recognizes that anything under /my-account; with an encoded trailing slash should match the cached rules for static assets, returning a cached hit.
2. The origin server, which does not normalize %2f nor collapse .. segments in the same way, interprets the request as GET /robots.txt behind the scenes, serving the contents of the robots file—including potential directory listings or disallowed paths.

This hybrid attack illustrates the importance of aligning normalization and routing logic between CDN layers and origin servers.

Defenders should ensure that caching policies strictly differentiate between static and dynamic content, normalize URLs consistently, and validate delimiters before caching responses.

Continuous auditing of path-handling behavior across all infrastructure layers is essential to prevent such deceptive manipulations from leaking sensitive information.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.