Research unveils a new CPDoS web cache poisoning attack

TH Koln researchers have discovered a new type of attack that can poison CDNs into caching, causing them to serve error pages instead of websites. This new attack is named CPDoS, short for Cache-Poisoned Denial-of-Service.

There are three variants of CPDoS attacks, HTTP Header Oversize (HHO), HTTP Meta Character (HMC) and HTTP Methos Override (HMO). As the names imply, the attack method includes malformed headers. It is possible to do so by using oversized header fields, meta character that can trigger errors, or instructions that override server responses.

TH Koln crew claims that they successfully carry the CPDoS attacks against the test websites hosted on the network of variety of CDN providers. It is possible to avoid these attacks by configuring their CDN service to not to cache HTTP error pages by default. This setting is easily accessible in most CDN service providers’ dashboards.

Stay tuned for up-to-date Cyber Security News