Hi everyone,

I've been doing a deep dive into Cache Poisoning to understand how the vulnerability class has evolved over the last decade.

While modern attacks involve complex gadgets and framework confusion, I realized that to truly understand them, you have to look at the "Foundational" attacks—the early logic flaws that started it all.

I analyzed 8 historical case studies from public bug bounty reports. Here are the 3 most interesting patterns that paved the way for modern exploitation:

1. The HackerOne Classic (2014)

• The Flaw: The server trusted the X-Forwarded-Host header without validation.
• The Attack: Sending X-Forwarded-Host: evil.com caused the application to generate a redirect to the attacker's domain.
• The Impact: The cache stored this redirect. Any legitimate user trying to visit HackerOne was seamlessly redirected to the attacker's site.

2. GitHub's Content-Type DoS

• The Flaw: GitHub handled Content-Type headers differently for the cache vs. the backend.
• The Attack: An attacker could send a request with a malformed content type. The backend would return an error, but the cache would store that error for all unauthenticated users visiting that repo.
• The Result: A simple request could DoS a repository for everyone.

3. The Cloudflare Capitalization Bug

• The Flaw: Cloudflare normalized headers (converting TaRgEt.CoM to target.com for the cache key), but the origin server treated them as distinct.
• The Impact: This allowed attackers to bypass cache keys and poison the response for a massive number of websites behind the CDN.

Why this matters today: Even though these are "old" reports, these exact logic flaws (normalization issues, unkeyed headers) are what cause the complex CP-DoS and secondary-context attacks we see in modern frameworks like Next.js today.

I wrote a full breakdown of all 8 case studies (including Shopify, GitLab, and Red Hat) if you want to see the specific request/response pairs.

Read the Full Analysis (Part 1)

Let me know if you have any questions about the mechanics of these early bugs!

Just came across this reverse engineering challenge called Malware Busters seems to be part of the Cloud Security Championship. It’s got a nice malware analysis vibe, mostly assembly focused and pretty clean in terms of setup.

Was surprised by the polish has anyone else given it a try?