CachePoisoning

Cache poisoning refers to a class of attacks in which an adversary inserts forged or misleading data into a computer cache, causing subsequent requests to be served falsified content rather than the original data. Caches targeted include DNS resolvers, HTTP proxies and content delivery networks, as well as web browsers and other caching intermediaries. By poisoning a cache, an attacker can redirect users to malicious sites, alter information, or cause denial of service by returning invalid responses.

DNS cache poisoning is one of the most widely discussed forms. Attackers aim to convince a resolver to accept false DNS answers for a domain, mapping it to an attacker-controlled address. Techniques exploit weaknesses in query handling, transaction identifiers, and port selection, and in some cases can exploit weaknesses in resolver software. The 2008 Kaminsky disclosure highlighted how insufficient randomness in DNS can enable widespread poisoning and prompted improved defenses, including the use of DNSSEC and stronger randomization.

Web cache poisoning affects shared web caches, proxies, or content delivery networks. An attacker crafts responses that a cache will accept as valid for a given request, often by manipulating headers such as Vary, Cache-Control, or Content-Type, or by exploiting URL normalization quirks. If cached content is served to other users, they may receive malicious scripts, malware, or spoofed pages. Defense relies on strict caching policies, input validation, and the use of HTTPS with integrity protections to prevent tampering.

Mitigation and best practices include enabling DNSSEC and strong query randomness for DNS caches, patching resolvers, and restricting which responses are cacheable. For HTTP caches, use no-store or no-cache for sensitive data, correct Cache-Control and Vary headers, revalidation, TLS, and authenticated delivery where possible. Regular auditing of caching rules and vendor security advisories also reduce risk.