Security researcher Alex Brumen from YesWeHack has described a new attack vector called Cache Key Injection that targets custom Nginx cache configurations. The vulnerability does not affect default Nginx setups but emerges when administrators concatenate multiple variable-length values without separators, for example $scheme$host$request_uri$http_accept.
Because two different requests can generate the same cache key string, an attacker who submits a request to /h with the header Accept: ome*/* can create an identical key to a legitimate request for /home with Accept: */*. If the attacker first stores a 404 response in the cache, subsequent users receive the error page instead of the homepage until the entry expires, resulting in CPDoS — cache-poisoned denial of service.
The same technique can expose restricted areas. In a lab example, the page /admin was accessible only from localhost, yet an attacker could request /ad and shift the remaining characters into an adjacent key component. Nginx would treat the path as authorized while serving the cached admin-panel content.
Under certain conditions the attack can also merge HTTP and HTTPS requests, allowing an attacker to store a page containing a malicious JavaScript reference and thereby turn the misconfiguration into stored XSS. Even Cloudflare does not always protect against the issue, because an Authorization header can route a request past Cloudflare’s cache directly to the vulnerable Nginx instance.
Protection is straightforward: cache keys must incorporate delimiters or structured encoding, for instance $scheme|$host|$request_uri|$http_accept. Administrators should also validate the Host header, enforce HTTPS redirects, and refrain from caching authenticated requests.
