Cache purge requests are not authenticated
Medium
C
curl
Submitted None
Actions:
Reported by
dhananjay09
Vulnerability Details
Technical details and impact analysis
## Summary:
Hello team,
Anyone can issue a PURGE request for any resource and invalidate your caches. That can lead to increased bandwidth costs but also potential Denial of Service attacks.
## Steps To Reproduce:
[add details for how we can reproduce the issue]
1.{Fundefined}
Unauthenticated cache purge request:
curl 'https://curl.se/' -X PURGE
{ "status": "ok", "id": "21729-1683784658-593921" }
2.{Fundefined}
## Supporting Material/References:
[list any additional material (e.g. screenshots, logs, etc.)]
* [attachment / reference]
https://sapt.medium.com/apple-hall-of-fame-for-a-small-misconfiguration-unauth-cache-purging-faf81b19419b
## Impact
That can lead to increased bandwidth costs but also potential Denial of Service attacks
Report Details
Additional information and metadata
State
Closed
Substate
Informative
Submitted
Weakness
Business Logic Errors