36 lines
1.2 KiB
YAML
36 lines
1.2 KiB
YAML
id: cdn-cache-poisoning
|
|
|
|
info:
|
|
name: Misconfigured CDN Cache Poisoning via X-Amz-Server-Side-Encryption Header
|
|
author: 0xcharan
|
|
severity: unknown
|
|
description: |
|
|
When the X-Amz-Server-Side-Encryption header is sent with user controlled value, it can lead to a misconfigured CDN cache response with a 400 status code, making the page inaccessible.
|
|
reference:
|
|
- https://portswigger.net/web-security/web-cache-poisoning
|
|
metadata:
|
|
verified: true
|
|
max-request: 2
|
|
shodan-query: X-Amz-Server-Side-Encryption
|
|
tags: cache,aws,poisoning,cdn
|
|
variables:
|
|
string: "{{to_lower(rand_base(8))}}={{to_lower(rand_base(8))}}"
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
GET /?{{string}} HTTP/1.1
|
|
Host: {{Hostname}}
|
|
X-Amz-Server-Side-Encryption: {{randstr}}
|
|
|
|
- |
|
|
GET /?{{string}} HTTP/1.1
|
|
Host: {{Hostname}}
|
|
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- 'contains(body_2, "{{randstr}}")'
|
|
- 'status_code_2==400'
|
|
condition: and
|
|
# digest: 4a0a004730450220345d526ad0b03bbd7f7bae52d8e4a0325ddcf89626e1b6a024dc08135f5da978022100d17a0b5fe8e92d017c4b6a74a000fb7b97b74a62d182c5a05d1d006a626ca8a7:922c64590222798bb761d5b6d8e72950 |