From d30edd94632f957d5f2a3fb111d942ec86613cdd Mon Sep 17 00:00:00 2001 From: carlospolop Date: Mon, 29 Sep 2025 13:19:01 +0200 Subject: [PATCH] f --- src/pentesting-web/cache-deception/README.md | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/src/pentesting-web/cache-deception/README.md b/src/pentesting-web/cache-deception/README.md index 3dd1c79d0..506efe1f3 100644 --- a/src/pentesting-web/cache-deception/README.md +++ b/src/pentesting-web/cache-deception/README.md @@ -376,16 +376,6 @@ Validation checklist - Confirm the authenticated header is present on the retargeted request (e.g., in a proxy or via server-side logs) and that the CDN caches the response under the traversed path. - From a fresh context (no auth), request the same path and confirm the secret JSON is served from cache. -Impact - -- Disclosure of bearer token or sensitive JSON for the authenticated user, enabling Account Takeover until expiry/rotation. - -Mitigations - -- Client: Normalize/validate path parameters used inside URL paths; reject /, .. and their encodings. Prefer strict routing helpers over string concatenation. -- Edge/CDN: Disable extension-based overrides for API paths; enforce no-store for sensitive endpoints at the edge; use strict cache keys that vary on Authorization and custom auth headers; segregate static content and APIs on separate hostnames with different caching policies. -- Auth: Avoid returning bearer tokens in cacheable contexts; scope tokens tightly and minimize TTL; rotate on use/suspicious access. - ## Automatic Tools