马丁·多伊纳德_全部缓存弯曲Web缓存利用规则_WP.pdf

1、Gotta Cache em allbending the rules of web cache exploitationMartin Doyhenard-tincho_508Through the years,we have seen many attacks exploiting web caches to hijack sensitiveinformation or store malicious payloads.However,as CDNs became more popular,new discrepancies between proprietary URL parserspr

2、ove that we have only seen the tip of the iceberg.In this paper will explore how different HTTP servers and proxies behave when parsing speciallycrafted URLs and explore ambiguities in the RFC that lead to path confusion.It will also introduce aset of novel techniques that can be used to leverage pa

3、rser discrepancies and achieve arbitraryweb cache poisoning and deception in countless websites and CDN providers.OutlineBackgroundWeb cachesPoisoning and deceptionURL discrepanciesDelimitersNormalizationArbitrary Web Cache DeceptionLimitationsStatic extensionsStatic directoriesStatic filesArbitrary

4、 Web Cache PoisoningKey normalizationExploiting back-end delimitersExploiting front-end delimitersCache-What-WhereDefenceBackgroundWeb cachesWeb caches have been around since the beginning of the internet.This technology works byfingerprinting requests using a key,which in most cases will be built u

5、sing some or all parts of therequested URL,and mapping the key with stored static responses.In recent years,most productive systems incorporate caching by setting Content Delivery Networks(CDNs)with providers like CloudFlare,Akamai,or CloudFront.CDNs can be seen as a network ofweb cache proxies that

6、 are distributed around the globe.They serve static responses,increasingthe efficiency and scalability of a system.This paper focuses on URL parsing discrepancies that exist between different application serversand CDN proxies,but the same techniques can be applied to any type of web cache,including