A newly discovered cache key injection technique, dubbed Cache Key Injection, allows attackers to circumvent access controls, expose cached sensitive information, trigger denial-of-service conditions, and potentially insert stored cross-site scripting payloads in vulnerable Nginx setups. This research, published by YesWeHack researcher Alex Brumen, shifts focus away from traditional web cache poisoning vulnerabilities that involve unkeyed HTTP input. New Cache Key Injection Attack web caches (Source: yeswehack) Web caches store HTTP responses under keys constructed from selected request properties, frequently including the scheme, host, URI, query string, cookies, or headers.
Nginx deployments may use a configuration similar to: proxy_cache_key "$scheme$proxy_host$uri$is_args$args$http_accept"; The risk is not in the unhashed nature of the resulting key.
Yeswehack revealed that two separate requests can result in the same final key when an attacker shifts characters between controllable fragments, such as the URL path and the Accept header. By manipulating Host headers, serving equivalent HTTP and HTTPS content, and embedding the host into a cacheable script source, an attacker can create a collision between HTTP and HTTPS cache entries. Adding separators or using structured encoding preserves the identity of each component; for instance, "$scheme|$host|$request_uri|$http_accept" eliminates ambiguity between adjacent fragments.
Defenders should also prevent caching of authenticated or access-controlled responses, strictly validate Host headers, redirect HTTP to HTTPS, and ensure CDN and origin-cache behavior is consistent.
