Hello guys,

Following my last post about web cache deception, and people asking for more caching issues, I promised a specific example of finding a valid bug by reading a disclosed report. No fancy tools, no exploits, just a browser and some thinking. Here it is.

A while back I was reading a writeup where a researcher found a stored XSS on a well known platform. The interesting part was how he found it. The page was reflecting some cookies and caching it, and he chained two different cookies together to bypass the WAF and execute the XSS for anyone visiting the site. Good finding, well written, the program fixed it and closed the report.

I read this writeup a year after it was disclosed. Everyone who read it learned about the XSS chaining technique and moved on. Cool story bro, next writeup.

I did not move on.

The XSS was fixed. But the question was: is the cache still there?

Indeed, it was there and it leaked user information...The platform, let's call it redacted, had an endpoint redacted/blog/\* that cached every page under this path. Since this was a large job posting platform, the leaked information was significant. Email, IP, ID, location, role, names. The kind of data that is valuable whether you are targeting hiring managers or job seekers.

Nobody noticed this while reading the original report because everyone was focused on the XSS chain. The cache leaking user information was sitting there in plain sight, mentioned nowhere.

I went and tested the same endpoint. The XSS was indeed gone. But the cache was still misconfigured, still storing authenticated responses publicly. No XSS needed. Any logged in user visiting those pages had their data exposed for anyone to read, no user interaction and fast expiring cache, trivial to automate it.

Now the fun part, the triage timeline.

I submitted the report.

\- The triager (the program's own triager) Jake came back asking for more information. 

Fair enough. I clarified the steps and added a cache buster parameter to the PoC URL, something like redacted/blog/page?ggg. This is important when testing cache issues so the triager sees their own data in the response and not someone else's data that was already cached. A small detail that matters a lot for reproducibility.

\- Jake validated it and then marked it low severity, reasoning that it required "social engineering" to exploit.

I pushed back. The attack requires zero user interaction. 

\- Jake disagreed and said he don't believe... Without the cache buster, he couldn't see his info 🙄

\- Paid a low bounty.

\- Came back and increased it after realizing he was wrong. The severity went from low to medium, which I still think is incorrect, but the fix happened and that is what matters.



Understanding what you are actually reading is what separates a closed door from an opportunity.

***The fix addresses what was reported. Not necessarily what caused it.*** The next time you read a writeup ask yourself one question: what did the fix actually change?

If you made it this far, what next? More examples or something else?

xlord91

Everyone Saw the XSS. I Saw the Cache: A Missed Data Leak in a Fixed Report