The use of web cache is prevalent among today's web services. Classical web service adopts the client-server architecture, where the client sends HTTP requests to the web server requesting web documents such as HTML pages, and the origin server will respond correspondingly. In the recent decade, with the substantial growth of various web applications, origin servers need to handle much more and more complex requests, to whom such burden becomes unbearable. The web caching service is introduced to offload the origin server under such circumstance. In the client-cache-server architecture, client's requests are instead sent to a cache server. If the cache server has a valid copy of the requested document, it will directly respond to the request without inquiring the origin server; otherwise, it will request the document from the origin server and forward it to the client, and meanwhile store a local copy that will be used to fulfill future requests to the same document. Such implementation, however, bears the risk of cache poisoning attack, i.e., if the cached document is tampered without being detected by the cache server, the tampered document will be used to serve all legitimate requests.
), public disclosure has been made in early Jan 2020.
Vulnerability #: VU#335217