Path parser disagreement and cache deception

One URL can acquire three different meanings: the origin’s handler path, the cache’s storage-policy path, and the cache key used for retrieval. Exploitation becomes possible when their transformations disagree in a useful direction.

Research anchor and scope

Martin Doyhenard’s cache research compares delimiter and normalization behavior and applies discrepancies to cache deception and poisoning. Its deception scenarios additionally require URLs that a victim’s browser can send. Framework and CDN behavior depends on versions and configuration; the article’s parser tables are research observations, not permanent specifications for every deployment.

Model transformations explicitly

Write separate functions for origin routing, cache admission, and key generation. Identify decoding order, delimiter handling, dot-segment removal, rewrite rules, and forwarding transformations. A cache may normalize a key but forward the original path, so testing only the origin’s final route misses the relevant discrepancy.

Consider a deliberately vulnerable toy router that treats the semicolon as the end of a handler name, paired with a cache policy that stores paths ending in .css. The request /profile;demo.css can reach the profile handler while looking static to the cache. Whether private data leaks further depends on storage directives, authentication, keying, and later unauthenticated retrieval. The delimiter disagreement alone is an intermediate primitive.

Build a parser experiment

First establish that an ordinary suffix changes the origin response; otherwise a permissive wildcard route may mimic delimiter behavior. Then add the candidate delimiter before that suffix. Use a cache miss to observe origin behavior. In a separate experiment, determine whether two path variants hit the same cached entry. Do not infer key equality solely because the bodies happen to be identical.

Test encoded and literal forms independently. A proxy might decode before forwarding, while the origin decodes again. A browser may remove dot segments or omit a fragment before either server sees it. Capture the actual request path at the client and origin in a local replica where possible.

Prove disclosure with two contexts

Use one test identity to populate a dedicated key with a unique harmless marker. Retrieve that key from a context without the original identity. This separates cache deception from ordinary authenticated access. Repeating the request with the same session proves much less, since a private cache or origin response can explain the result.

Record which cache rule overrides which response directive and how long the entry persists. Default file-extension rules do not imply that every dynamic response is stored. A header-only exploit that works in a custom client may fail as a victim-triggered link. Cache poisoning and deception share parser inconsistencies but reverse the data flow: one stores attacker-influenced responses for others; the other stores a victim-specific response for later retrieval.