CACHE POISONING CASE STUDIES PART 1: FOUNDATIONAL ATTACKS BEHIND A $100K+ VULNERABILITY CLASS

Summary from the TLDR InfoSec newsletter

Cache poisoning is a web security vulnerability in which attackers trick caching systems, such as CDNs or proxies, into storing malicious responses, serving them to other users, and causing widespread harm. Early real-world examples from platforms such as HackerOne, GitHub, and Shopify show that unvalidated headers like X-Forwarded-Host or Content-Type can trigger global redirects, denial-of-service attacks, or stored XSS across multiple domains. These foundational cases, often yielding bounties of $2,500 to $6,300, highlight risks such as method overrides in cloud storage and social media amplification via Open Graph tags.