4 ms·

Cache Poisoning at Scale

• throwaway984393 5y ago
  Jesus Christ, this is massive! Props to Youstin, great work. This is the kind of stuff that keeps people on the internet safe from major attacks with fancy names. I hope he got his bounties!
• criticaltinker 5y ago
  > Since both hosts were behind the same loadbalancer, it was possible to cache files hosted on redacted-cdn.com under assets.redacted.com, inherently allowing me to move the vulnerable html file on a different domain and achieve xss under a different origin. Oof that Fastly XSS seems particularly nasty, and no mention of the bounty. Am I understanding correctly that any website hosted on Fastly was vulnerable to XSS because of this?
• maxim_b 5y ago
  Seems like he was rewarded a total of $24,150 for all bounties together. I'm not experienced with bug bounty programs but while that is a nice payday it still seems rather low for the severity of the bugs.
• wdb 5y ago
  Great read, helped me understand cache poisoning better :)
• tyingq 5y ago
  >Moreover, ATS generates cache keys by extracting the host, path and query, ignoring the url fragment. Seems like this should note that browsers don't send the url fragment in the request. It's solely used browser-side. That's why it shouldn't forward the fragment on.