Web Cache Poisoning & WAF Evasion: A Case Study in Cache Entanglement

At XECbuild, we consistently advocate that relying on automated scanners inherently creates a false sense of security. Automated tools often misinterpret edge-case WAF blocks as fixed vulnerabilities, missing the underlying architectural flaws. True security resilience requires analyzing the business logic and understanding the interplay between origin servers and edge caching layers.

Recently, our manual, precision-based methodology uncovered a critical Web Cache Poisoning vulnerability via Cache Entanglement on a prominent content platform (Shout Me Crunch). This engagement highlights the danger of misconfigured caching rules and resulted in an exceptional 4-hour remediation turnaround and a placement in their Security Hall of Fame.

🔍 The Architectural Setup

During the vulnerability assessment, the target's infrastructure was mapped. The architecture relied on an origin server utilizing WP-Super-Cache, heavily shielded at the edge by Cloudflare’s Web Application Firewall (WAF).

Initial fuzzing revealed that a specific parameter (content) was reflecting directly within the DOM, specifically nested inside a JSON object used for telemetry analytics. While an automated tool might flag this as simple Reflected XSS, the presence of caching layers indicated a much higher potential impact: Web Cache Poisoning.

🪤 The Trap: Misinterpreting the WAF

To prove impact, a standard Cross-Site Scripting (XSS) payload (<script>alert()</script>) was initially injected, utilizing a cache-buster parameter to ensure zero impact on live users.

The result was an immediate Cloudflare Anti-Bot challenge page. The WAF successfully intercepted the malicious tags before the request ever reached the backend.

Many security practitioners and automated scanners stop here, assuming the WAF has mitigated the risk. However, a WAF blocking an XSS payload does not mean the underlying caching vulnerability is patched—it simply requires a tactical pivot.

⚙️ The Exploit: Proving Cache Entanglement

To prove the cache was broken, the execution strategy shifted from XSS to Content Spoofing/Cache Defacement. The goal was to deploy a payload that Cloudflare would categorize as benign, but the backend origin would still cache and serve to other users.

Phase 1: Poisoning the Origin Cache
A crafted HTTP GET request was sent using a simple, tag-less string to effortlessly bypass Cloudflare's WAF.

The response returned an HTTP/2 200 OK. Deep within the response, the benign payload was successfully reflected. Crucially, the WP-Super-Cache timestamp embedded at the bottom of the HTML confirmed that a fresh cache had just been generated by the origin server.

Phase 2: Verifying Entanglement
To definitively prove Web Cache Poisoning, one must demonstrate that a victim receives the poisoned payload *without* having the malicious parameter in their URL.

Navigating to the clean, unparameterized URL in a fresh environment confirmed the exploit. The injected string was present in the source code of the clean URL. The origin caching plugin had ignored the unkeyed parameter when creating the cache key, irreversibly entangling the poisoned response with the clean URL path for all subsequent visitors.

⚠️ The Business Risk

The impact of this cache entanglement is severe. By bypassing the WAF with arbitrary text, an advanced threat actor could silently manipulate high-traffic pages. This allows for targeted phishing campaigns, the rendering of fraudulent login portals, and massive reputational damage. Furthermore, if a WAF bypass for JavaScript execution was ever discovered, this vulnerability would immediately escalate to unauthenticated, zero-click Stored XSS for all site visitors.

🏆 Remediation and Core Philosophy

A comprehensive report detailing the exact methodology, WAF evasion, and cache entanglement was submitted to the organization's security team. The response was exemplary: within exactly four hours, the infrastructure team acknowledged the report, swapped the vulnerable caching mechanism, hardened their .htaccess configurations, and secured the edge.

The Key Takeaway for Enterprises:
A WAF is a filter, not a fix. Edge firewalls cannot compensate for fundamentally broken origin caching rules. Organizations must ensure that all parameters reflecting in the DOM are strictly included in the cache key. At XECbuild, we secure the complex architectural layers that automation leaves behind.