# Web cache poisoning

Unkeyed attacker-controlled input changes a representation later served from shared cache.

**Candidate CWE:** [CWE-349](https://cwe.mitre.org/data/definitions/349.html)

## Test hypothesis

Prove a dedicated cache namespace. Change one source-confirmed unkeyed input to a harmless marker; request the same key from controlled B without that input and compare a clean key.

## Evidence required

B receives the altered cached representation, supported by origin/cache logs and exact key behavior. Describe the demonstrated output impact and purge test entries.

## Rule out false positives

Reflected input on the initial request, an ignored query cache-buster, or caching isolated to the submitting user is not cross-client poisoning.

## Playbook and command references

- [Proxy normalization, cache isolation, and request boundaries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/proxy-cache.html) — Investigate layered HTTP behavior with isolated cache keys and controlled front-end/back-end traffic.

[Find the associated command snippets](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/commands.html?q=Proxy%20normalization%2C%20cache%20isolation%2C%20and%20request%20boundaries)

## Referenced by these target playbooks

[Web & API](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/web-api.html) · [OSS & self-hosted](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/oss.html) · [Cloud & containers](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/cloud.html) · [Network services](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/network.html)

## Report checklist

- [ ] Capture the affected version, configuration, identities, and object ownership.
- [ ] Preserve a valid baseline and a negative control.
- [ ] Reproduce the forbidden data access, action, or state change on controlled fixtures.
- [ ] Explain the intended security rule and why the observed behavior violates it.
- [ ] State prerequisites, uncertainty, cleanup, and the smallest demonstrated impact.

## Conditional ATT&CK mapping

No direct ATT&CK mapping selected. Record the weakness and demonstrated impact without forcing an adversary-behavior classification. See the [mapping guide](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/attack.html).

## Primary references

- [PortSwigger cache poisoning](https://portswigger.net/web-security/web-cache-poisoning)

[Back to the complete vulnerability catalog](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities.html)