New Cache Deception Attack Exploits Miscommunication Between Cache and Web Server

A newly documented cache deception attack leverages mismatches in path normalization and delimiter handling between caching layers and origin servers to expose sensitive endpoints and steal authentication tokens, according to GBHackers On Security. Researchers have demonstrated how subtle discrepancies in URL processing can trick a content delivery network into caching protected resources, enabling an attacker to retrieve them later without authenticating.

The attack hinges on a miscommunication between the cache and the origin server, where different systems interpret URLs differently, allowing sensitive pages to be cached and later retrieved.

An example shows chat.openai[.]com/api/auth/session[.]css returning a 400 and not being cached, while chat.openai[.]com/api/auth/session/test[.]css is cached because it appears under a “share” directory, and a crafted URL such as https://chat.openai[.]com/share/%2F..%2Fapi/auth/session?cachebuster=123 can cause the CDN to cache the path while the origin normalises it to a protected endpoint.

Mitigations include enforcing consistent URL normalization, ensuring sensitive endpoints carry non-cacheable headers, auditing CDN rules, and applying strict routing rules that ignore arbitrary suffixes and set cache-control headers like no-store on authenticated endpoints.