Cache Poisoning & Cache Deception

Affect one user → affect millions.

When to invoke

Trigger phrases:

• "cache poisoning"
• "web cache"
• "CDN attack"
• "cache deception"

Two distinct attacks

Cache Poisoning

Attacker sends a crafted request → response contains malicious content → cache stores it → all subsequent users get the malicious response.

Cache Deception

Attacker tricks the cache into storing another user's authenticated content at a public URL → attacker reads private data via cache.