&#x22;&#x3E;&#x3C;h1&#x3E;gg&#x3C;/h1&#x3E;

Our investigation began when @dk4trim noticed something unusual on an endpoint 

. The response was being cached, and intriguingly, it included user-specific details even though @dk4trim didn't have an account. By adding a cache buster, we verified the issue further.

fabrikat0r

dk4trim

Using Leaked Cookies: With cookies obtained from the poisoned cache, an attacker could request a JWT. The system would issue a JWT without checking nonce and state, granting the attacker access to the user’s account.

Stay tuned for more updates, and as always, feel free to reach out with any questions or comments.

Waiting Period: There’s a potential waiting period before the cache is refreshed, giving the attacker a window to exploit.

This vulnerability is a stark reminder of the importance of robust security practices in cache management and JWT creation. By combining cache poisoning with a misconfigured JWT process, attackers can achieve a complete account takeover, compromising user data and system integrity. Immediate action is required to address and mitigate this severe security flaw.

Authenticated Request with Cache Buster: An authenticated user then makes a request with a cache buster parameter, which leads the server to cache this new response, including the user’s cookies.

Exploitation: An attacker can now visit the same URL with the cache buster on a different device and get the cached response, which includes the authenticated user’s c

Missing State and Nonce Checks: The system allowed JWT creation without validating state and nonce parameters, essential checks to prevent replay attacks.

Welcome to our latest blog post, where we delve into a critical security vulnerability that @dk4trim and I, @fabrikat0r, discovered during our recent collaboration. This flaw combines two major issues: cache deception and a misconfigured JWT creation process, which together can lead to a full Account Takeover (ATO). Here’s our journey through the discovery, proof of concept, and implications of this serious vulnerability.

Initial Request Without Cookies: An unauthenticated request is made to the server, resulting in a cacheable response at xxx/academy/Header?caching=here.

In parallel, we found a critical issue in the JWT creation process:

Special thanks to dk4trin for collabration

I, having an account, logged in and found that the cookies were being cached as well. This seemed like a huge problem, but things escalated when we remembered stumbling upon a misconfigured OAuth endpoint. This endpoint wasn’t checking the nonce and state parameters, meaning JWTs could be created with any values.

The cache poisoning issue unfolds as follows:

Yash Chavhan

Yash chavan

nikhil

ketan jain

Atharv shejwal

Yash Testfffhhhg

Suvendu Dash

In this blog @dk4trin and I, @fabrikat0r expose a critical security flaw combining cache deception and misconfigured JWT creation.