Loading HuntDB...

Cache purge requests are not authenticated

Medium
C
curl
Submitted None
Reported by dhananjay09

Vulnerability Details

Technical details and impact analysis

Business Logic Errors
## Summary: Hello team, Anyone can issue a PURGE request for any resource and invalidate your caches. That can lead to increased bandwidth costs but also potential Denial of Service attacks. ## Steps To Reproduce: [add details for how we can reproduce the issue] 1.{Fundefined} Unauthenticated cache purge request: curl 'https://curl.se/' -X PURGE { "status": "ok", "id": "21729-1683784658-593921" } 2.{Fundefined} ## Supporting Material/References: [list any additional material (e.g. screenshots, logs, etc.)] * [attachment / reference] https://sapt.medium.com/apple-hall-of-fame-for-a-small-misconfiguration-unauth-cache-purging-faf81b19419b ## Impact That can lead to increased bandwidth costs but also potential Denial of Service attacks

Report Details

Additional information and metadata

State

Closed

Substate

Informative

Submitted

Weakness

Business Logic Errors