HIGH adonisjscache poisoning

Cache Poisoning in Adonisjs

Cache Poisoning in AdonisJS: A Practical Analysis

Cache poisoning occurs when an attacker manipulates cached responses to serve malicious or incorrect data to legitimate users. In AdonisJS1, this risk primarily emerges through improper configuration of response caching for authenticated or user-specific endpoints, especially when using the built-in Cache facade or third-party middleware that relies on HTTP cache headers.

AdonisJS applications often cache API responses to improve performance, particularly for read-heavy endpoints like user profiles or public resource listings. However, if caching is applied without proper validation of user identity, role, or request context, an attacker can poison the cache by sending a request with another user's authorization token, thereby forcing the system to store a response intended for one user and serve it to others.

For example, consider an endpoint that returns user-specific data:

// routes.js
export default class UserController {
  @http.get('/api/user/profile')
async profile({ request, response, auth }) {
    const user = await auth.authenticate()
    const profile = await Database.from('profiles').where('user_id', user.id).first()
    return response.json(profile)
  }
}

If this endpoint is mistakenly configured to be cached globally — perhaps via middleware that sets Cache-Control: public — then the response will be stored in a shared cache (e.g., Redis or CDN) and served to any subsequent request, regardless of the authenticated user. An attacker who first accesses the endpoint with their own credentials will poison the cache, and subsequent requests from other users will receive the poisoned profile data.

Another common vector is when developers use the Cache::remember() helper directly in controller logic without binding it to a per-user key:

// controller.js
const profile = await Cache.remember('user_profile', 3600, async () => {
  return await Database.from('profiles').where('user_id', auth.user.id).first()
})
return response.json(profile)

Here, if Cache.remember() is called without incorporating the authenticated user's ID into the cache key, multiple users' data can overwrite each other. The cache key 'user_profile' will map to the last stored profile, leading to data leakage across users.

Additionally, AdonisJS's integration with edge caching services (e.g., via Cloudflare or Fastly) can exacerbate the risk if response headers are misconfigured. For instance, setting Cache-Control: public, max-age=3600 on a response that includes session-specific or role-based data will allow any cache node to store and reuse the response, potentially exposing sensitive information to unauthorized users.

To detect such issues, security tools must validate whether caching mechanisms are correctly scoped to user context. middleBrick2 performs black-box scanning of AdonisJS endpoints by analyzing HTTP responses for improper caching directives and testing whether unauthenticated or alternate-authenticated requests can trigger the storage of user-specific responses in shared cache layers. It checks for the presence of Cache-Control headers that permit public caching on endpoints that should be private, and it probes whether responses vary based on authentication state.

For example, a vulnerable endpoint might return Cache-Control: public even when accessed with a session token. middleBrick would send two requests: one unauthenticated and one authenticated as User A. If both responses are identical and cached under a shared key, the tool flags this as a potential cache poisoning risk.

Furthermore, middleBrick parses OpenAPI specifications to detect misconfigured caching directives. If an endpoint is annotated with @cache-control public in its Swagger definition without user-specific parameters, it raises a warning. This spec-aware scanning ensures that even if caching headers are set correctly at runtime, the documentation does not align with safe practices.

In summary, cache poisoning in AdonisJS stems from improper scoping of cached responses, misuse of caching helpers without user-bound keys, and incorrect cache header configurations. These flaws can lead to data leakage, session hijacking, and unauthorized data access — particularly dangerous in applications handling sensitive user information.

FAQ

Q1: Can cache poisoning lead to authentication bypass in AdonisJS?
A: Yes. If a cached response for an authenticated admin endpoint is poisoned, an attacker who triggers the cache can receive privileged data without re-authenticating. For instance, if an admin-only API response is cached with Cache-Control: public, any user can retrieve it from the cache, potentially exposing admin-only functionality or data.

Q2: Does middleBrick test for cache poisoning in AdonisJS APIs?
A: Yes. middleBrick performs black-box probing of AdonisJS endpoints to detect improper caching behaviors. It checks for public caching on authenticated routes, tests whether responses vary by user context, and validates that cache keys incorporate user identifiers when required. Findings are mapped to OWASP API Top 10 category A01:2023 — Broken Object Level Authorization, which often overlaps with improper caching risks.

Q1: How does middleBrick detect cache poisoning vulnerabilities in AdonisJS APIs?
A: middleBrick sends unauthenticated and authenticated requests to the same endpoint, then compares whether the cached response contains user-specific data (e.g., profile details) that should not be shared. If both requests return identical cached responses, it indicates a lack of proper cache key scoping. This black-box probing identifies risks where responses are incorrectly cached without dependency on authentication context.

Q2: Can cache poisoning in AdonisJS expose sensitive user data?
A: Yes. If an endpoint returning user-specific data (e.g., personal profile or billing information) is cached with Cache-Control: public or without user-bound cache keys, attackers can poison the cache by sending a request with another user's credentials. Subsequent users will receive the poisoned response, leading to unauthorized data access. middleBrick flags such scenarios during scanning.

Question: How does middleBrick detect cache poisoning in AdonisJS APIs?
Answer: middleBrick sends unauthenticated requests and authenticated requests with different user contexts to the same endpoint. If the response is cached and identical across both requests — especially when it contains user-specific data — middleBrick flags it as a potential cache poisoning risk. It validates that caching behavior does not improperly expose sensitive data to unauthorized users.

Question: Can cache poisoning in AdonisJS lead to data leaks?
Answer: Yes. If a response for a user-specific endpoint (e.g., /api/user/profile) is cached without incorporating the authenticated user ID into the cache key, and is served with Cache-Control: public, an attacker can trigger the cache with their own credentials. Later, another user receives the cached response meant for the attacker, leading to unauthorized data exposure. middleBrick detects such misconfigurations via black-box probing.

Q2: Can cache poisoning in AdonisJS expose sensitive user data?
A: Yes. If an endpoint returning user-specific data (e.g., personal profile or billing information) is cached with Cache-Control: public or without user-bound cache keys, attackers can poison the cache by sending a request with another user's credentials. Subsequent users will receive the poisoned response, leading to unauthorized data exposure. middleBrick detects such misconfigurations via black-box probing.

Cache Poisoning in Adonisjs

Cache Poisoning in AdonisJS: A Practical Analysis

FAQ

Related Pages