该漏洞主要是cdn安全配置的问题，cdn主要存储以下文件，加快访问速度

class, css, jar, js, jpg, jpeg, gif, ico, png, bmp, pict, csv, doc, docx, xls, xlsx, ps, pdf,
pls, ppt, pptx, tif, tiff, ttf, otf, webp, woff, woff2, svg, svgz, eot, eps, ejs, swf, torrent,
midi, mid

存在漏洞的地址：http://www.xx.com/cc.css位于cdn缓存上，但是访问该css同http://www.xx.com/home.php一样，所以造成了该漏洞

漏洞利用：将http://www.xx.com/cc.css地址发给笑脸用户，用户在上面的操作会留在cdn缓存上，造成了泄漏，这个时候，恶意攻击者访问该用户就造成了，缓存欺骗。

以下为hackone案例，仅供参考，顺便提下，案例二的poc可以进行证明漏洞

一：ronr submitted a report to Vanilla.

Jun 2nd (8 months ago)

I have found a Vulnerability in vanilla forums which called Web cache deception attack.

Web Cache Deception Attack

Websites often tend to use web cache functionality to store files that are often retrieved, to reduce latency from the web server.

Websites often tend to use web cache functionality (for example over a CDN, a load balancer, or simply a reverse proxy). The purpose is simple: store files that are often retrieved, to reduce latency from the web server.
When accessing a URL like http://www.example.com/home.php/non-existent.css
A GET request to that URL will be produced by the browser. The server returns the content of http://www.example.com/home.php. And yes, the URL remains http://www.example.com/home.php/non-existent.css. The HTTP headers will be the same as for accessing http://www.example.com/home.php directly: same caching headers and same content type (text/html, in this case).
The web cache servre saves the returned page in the server's cache. Then the attacker can go to the url: http://www.example.com/home.php/non-existent.css and the page of the victim will be presented with the victim's sensitive information (The page content).

The dangerous part in this attack, unlike phishing attacks, is that the url isn't looks suspicious at all. It looks like a normal url from the original website, so the victim thinks that it is ok to click on the link.

Steps:

  1. The attacker sends the following link to the victim: https://open.vanillaforums.com/messages/all/non-existent.css
  2. The victim opens the link and the inbox page will be loaded normally. (The web cache server then saves this page)
  3. The attacker open the same link (https://open.vanillaforums.com/messages/all/non-existent.css), and the inbox page of the victim with all his private contant is loaded.

If you need a video to understand it better, ask me and I will send you one.

Impact

The attacker can achieve all the private content of a specific victim, without the victim knowing about it.

二：

Hello,
Your Web-Server is vulnerable to web cache poisoning attacks.
This means, that the attacker are able to get another user informations.

If you are logged in and visit this website (For example):
https://postmates.com/SomeRandomText.css

Then the server will store the information in the cache, BUT with the logged in user information :)
A non-logged-in user can then visit this website and see the information contained therein.
In that case, this url: https://postmates.com/SomeRandomText.css

I have written a small javascript / html code, which executes this attack fully automated, you just need to visit the website and wait like 3 seconds.

Here is the small PoC code

<html>

<head>

</head>

<body>

<script>

    var cachedUrl = 'https://postmates.com/' + generateId() + '.css';

    const popup = window.open(cachedUrl);

    function generateId() {

        var content = '';

        const alphaWithNumber = 'QWERTZUIOPASDFGHJUKLYXCVBNM1234567890';

        for (var i = 0; i < 10; i++) {

            content += alphaWithNumber.charAt(Math.floor(Math.random() * alphaWithNumber.length))

        }

        return content;

    }

    var checker = setInterval(function() {

        if (popup.closed) {

            clearInterval(checker);

        }

    }, 200);

    var closer = setInterval(function() {

        popup.close();

        document.body.innerHTML = 'Victims content is now cached <a href="' + cachedUrl + '">here and the url can be saved on the hackers server</a><br><b>Full Url: ' + cachedUrl + '</b>';

        clearInterval(closer);

    }, 3000);

</script>

</body>

</html>

Theoretically, the attacker could then store this information on his server, but in this example, the URL is simply shown.
I would suggest keeping an eye on caching for more security and hope you enjoyed my report.

Some informations about the attack:
https://www.blackhat.com/docs/us-17/wednesday/us-17-Gil-Web-Cache-Deception-Attack.pdf

The screenshots with the steps are in the attachments

Not important for this report, but i want to look deeper in your website: Can you create an account for me? Im from Germany and dont have american phone number :)

Impact

Web cache poisoning attack can be used to steal user informations like lastname and member id which is important for the login security feature. (For example)

Web缓存欺骗的更多相关文章

  1. 【转】一种新型的Web缓存欺骗攻击技术

    为了减少WEB响应时延并减小WEB服务器负担,现在WEB缓存技术已经用的非常普遍了,除了专门的CDN,负载均衡以及反向代理现在也会缓存一部分的网页内容.这里我要介绍一种WEB缓存欺骗攻击技术,这种攻击 ...

  2. 作为前端应当了解的Web缓存知识

    缓存优点 通常所说的Web缓存指的是可以自动保存常见http请求副本的http设备.对于前端开发者来说,浏览器充当了重要角色.除此外常见的还有各种各样的代理服务器也可以做缓存.当Web请求到达缓存时, ...

  3. Web缓存杂谈

    一.概述 缓存通俗点,就是将已经得到的‘东东’存放在一个相对于自己而言,尽可能近的地方,以便下次需要时,不会再二笔地跑到起始点(很远的地方)去获取,而是就近解决,从而缩短时间和节约金钱(坐车要钱嘛). ...

  4. 前端应当了解的Web缓存知识

    缓存优点 通常所说的Web缓存指的是可以自动保存常见http请求副本的http设备.对于前端开发者来说,浏览器充当了重要角色.除此外常见的还有各种各样的代理服务器也可以做缓存.当Web请求到达缓存时, ...

  5. 浅谈Web缓存

    在前端开发中性能一直都是被大家所重视的一点,然后判断一个网站的性能最直观的就是看网页打开的速度. 其中提高网页反应的速度的一个方式就是使用缓存.一个优秀的缓存策略可以缩短网页请求资源的距离,减少延迟, ...

  6. web缓存

    web缓存HTTP协议的一个核心特性,它能最小化网络流量,并且提升用户所感知的整个系统响应速度. 什么能被缓存? *Logo和商标图像 *普通的不变化的图像(例如,导航图标) *CSS样式表 *普通的 ...

  7. Web 技术人员需知的 Web 缓存知识(转)

    最近的译文距今已有4年之久,原文有一定的更新.今天踩着前辈们的肩膀,再次把这篇文章翻译整理下.一来让自己对web缓存的理解更深刻些,二来让大家注意力稍稍转移下,不要整天HTML5, 面试题啊叨啊叨的~ ...

  8. c# web 缓存管理

    using System; using System.Collections; using System.Text.RegularExpressions; using System.Web; usin ...

  9. HTML5时代的Web缓存机制

    HTML5 之离线应用Manifest 我们知道,使用传统的技术,就算是对站点的资源都实施了比较好的缓存策略,但是在断网的情况下,是无法访问的,因为入口的HTML页面我们一般运维的考虑,不会对其进行缓 ...

随机推荐

  1. go 模板详说

    模板是我们常用的手段用于动态生成页面,或者用于代码生成器的编写等.比如把数据库的表映射成go语言的struct,这些体力活,写个代码生成器是最合适不过的了. 示例例把表转成 struct : 当然这篇 ...

  2. maven的安装及环境变量配置

    1.下载maven 2.解压至该路径 3. 新建环境变量MAVEN_HOME , 值为maven包点开路径 环境变量配置: 4. 编辑环境变量Path,追加%MAVEN_HOME%\bin\ 5.一路 ...

  3. Linux目录、文件的管理

    centos目录结构 ls / 查看根目录下有哪些文件或者目录 bin 可执行文件的目录 sbin 存放root用户可执行文件目录 etc 配置文件 boot 引导文件 home 普通用户宿主目录 l ...

  4. SAP登录消息提醒

      1功能说明 在相应用户登录时,给其提示相关信息. 2功能实现 2.1函数实现 在函数NAVIGATION_SET_START_TCODE中注册要监听的用户和程序的事务代码,当用户登录时,将自动运行 ...

  5. Scrapy模块使用出错，出现builtins.ImportError: DLL load failed: 找不到指定的程序

    问题描述:初次学习scrapy,使用scrapy官方文档创建爬虫项目出错, 出现builtins.ImportError: DLL load failed: 找不到指定的程序, ImportError ...

  6. Spring Boot Admin简介及实践

    问题 在若干年前的单体应用时代,我们可以相对轻松地对整个业务项目进行健康检查.指标监控.配置管理等等项目治理.如今随着微服务的发展,我们将大型单体应用按业务模型进行划分,以此形成众多小而自治的微服务, ...

  7. HDU 3874 Necklace 区间查询的离线操作

    题目: http://acm.hdu.edu.cn/showproblem.php?pid=3874 对需要查询的区间按右端点排序,然后从左到右依次加入序列中的元素,同时更新,更新的方法是,把上一次出 ...

  8. [BC冠军赛(online)]小结

    A Movie 题意:给你n个区间,判断能否选出3个不相交的区间. 思路:令f(i)表示能否选出两个不相交区间并且以区间i为右区间的值,g(i)表示能否选出两个不相交区间并且以区间i为左区间的值,如果 ...

  9. jquery 扫码实现入库登记管理

    刚才跟一位分享的大神讲了关于项目中的需求,因为是第一次做这样的需求,还是蒙蒙的,现在把设计图给大家看看,大家有没有做过这样的需求业务,请多多指教!

  10. Python单元测试框架：unittest（二）

    一.直接使用TestCase 注意所有测试方法都需要以test开头.代码如下: import unittest class Test1(unittest.TestCase): @classmethod ...