New Cache Poisoning Attack Lets Attackers Target CDN Protected Sites

DDE_Server · Oct 23, 2019

A team of German cybersecurity researchers has discovered a new cache poisoning attack against web caching systems that could be used by an attacker to force a targeted website into delivering error pages to most of its visitors instead of legitimate content or resources.

The issue affects reverse proxy cache systems like Varnish and some widely-used Content Distribution Networks (CDNs) services, including Amazon CloudFront, Cloudflare, Fastly, Akamai, and CDN77.

In brief, a Content Distribution Network (CDN) is a geographically distributed group of servers that sit between the origin server of a website and its visitors to optimize the performance of the website.

A CDN service simply stores/caches static files—including HTML pages, javascript files, stylesheets, images, and videos—from the origin server and delivers them to visitors more quickly without going back to the originating server again and again.

Each of the geographically distributed CDN server, known as edge nodes, then also shares the exact copy of the cache files and serve them to visitors based on their locations.

Generally, after a defined time or when manually purged, the CDN servers refresh the cache by retrieving a new updated copy of each web page from the origin server and store them for future requests.

How Does CPDoS Attack Work Against CDNs?

Dubbed CPDoS, short for Cache Poisoned Denial of Service, the attack resides in the way intermediate CDN servers are incorrectly configured to cache web resources or pages with error responses returned by the origin server.

The CPDoS attack threatens the availability of the web resources of a website just by sending a single HTTP request containing a malformed header, according to three German academics, Hoai Viet Nguyen, Luigi Lo Iacono, and Hannes Federrath.

"The problem arises when an attacker can generate an HTTP request for a cacheable resource where the request contains inaccurate fields that are ignored by the caching system but raise an error while processed by the origin server."

Here's how the CPDoS attack works:

A remote attacker requests a web page of a target website by sending an HTTP request containing a malformed header.
If the intermediate CDN server doesn't have a copy of the requested resource, it will forward the request to the origin web server, which will get crash due to the malformed header.
As a consequence, the origin server then returns an error page, which eventually gets stored by the caching server instead of the requested resource.
Now, whenever legitimate visitors try to obtain the target resource, they will be served the cached error page instead of the original content.
The CDN server will also spread the same error page to other edge nodes of the CDN's network as well, rendering targeted resources of the victim's website unavailable.

"It is worth noting that one simple request is sufficient to replace the genuine content in the cache by an error page. This means that such a request remains below the detection threshold of web application firewalls (WAFs) and DDoS protection means, in particular, as they scan for large amounts of irregular network traffic."

"Moreover, CPDoS can be exploited to block, e.g., patches or firmware updates distributed via caches, preventing vulnerabilities in devices and software from being fixed. Attackers can also disable important security alerts or messages on mission-critical websites such as online banking or official governmental websites."

3 Ways to Launch CPDoS Attacks

To carry out this cache poisoning attacks against CDNs, the malformed HTTP request can be of three types:

HTTP Header Oversize (HHO) — An HTTP request containing an oversized header that works in scenarios where a web application uses a cache that accepts a larger header size limit than the origin server.
HTTP Meta Character (HMC) — Instead of sending an oversized header, this attack tries to bypass a cache with a request header containing a harmful meta character, such as line break/carriage return (\n), line feed (\r) or bell (\a).
HTTP Method Override (HMO) — Using HTTP override header to bypass the security policy that prohibits DELETE requests.

CDN Services Vulnerable to CPDoS Attacks

Researchers carried out three attacks against different combinations of web caching systems and HTTP implementations and found that Amazon's CloudFront CDN is the most vulnerable to the CPDoS attack.

The rest of article from here: