Cache Management: Web Cache Poisoning

An attacker can use Web Cache Poisoning to exploit the application and deliver a malicious response to a legitimate request

In Web Cache Poisoning (WCP) the attacker exploits the behavior of caches. This is done by exploiting multiple mechanisms. Some of which include identifying unkeyed inputs such as headers. Unkeyed inputs are used to construct the response but are not the part of cache key.
Web cache ignores the unkeyed input when sending responses. Therefore, it sends the malicious responses that the attacker had cached with the help of these unkeyed inputs.
The unkeyed inputs can be reflected in the response or can be used to dynamically generate responses.
Another mechanism uses fat GET requests. Fat GET requests are GET requests with a request body. An attacker can duplicate a query parameter in the request body with attacker-controlled value and trick an application into responding differently. An intermediate cache might ignore such a request body when caching the response and respond with a cached fat GET response when a normal request arrives.

WCP is possible through a variety of methods including unkeyed headers, fat GET requests, unkeyed ports, unkeyed query parameters, and more.