Web cache poisoning: poisoning what everyone is served

Caches serve the same response for the same key (usually URL + some headers). If a non-key input affects the response, you poison it for everyone.

The mechanism

Headers like X-Forwarded-Host often are not in the key but are reflected (in a link, a script). The attacker sends a request with the manipulated header; the poisoned response is cached and served to subsequent victims.

GET / HTTP/1.1
X-Forwarded-Host: evil.com   # ends up in <script src="//evil.com/...">
# the cached response serves the malicious script to all

Defence

Include in the cache key every input that affects the response, or (better) do not reflect untrusted headers. Configure the cache not to store responses that depend on non-key headers. Test with tools like Param Miner to find "unkeyed" inputs.