Cache Poisoning in Django with Dynamodb

Cache poisoning occurs when an attacker causes cached data to store incorrect or malicious content. In a Django application using Amazon DynamoDB as a cache backend or persistent data store, this typically arises from insufficient input validation and unsafe use of cached values in DynamoDB query responses. If user-controlled data influences cache keys or is stored directly in DynamoDB items that are later used to construct queries, an attacker can inject crafted values that change the meaning of cached results.

DynamoDB itself does not execute logic or render templates, so the poisoning happens at the application layer: Django builds a cache key or query condition using raw input, persists it to DynamoDB, and later reuses that key/condition without normalization or strict validation. For example, a paginated endpoint that uses a page parameter to build a DynamoDB Query with a FilterExpression can have the page value reflected in cached entries. If an attacker forces cache keys like page=1 and page=1 OR 1=1 to be stored, subsequent reads may retrieve unexpected items or bypass intended filters. Sensitive data exposure can occur if poisoned cache entries cause the application to retrieve or display data belonging to other users, especially when cache keys incorporate user IDs or tenant identifiers without proper scoping.

Because middleBrick tests unauthenticated attack surfaces and includes input validation and data exposure checks, such misconfigurations are detectable. A DynamoDB-backed cache that does not canonicalize keys, lacks strict type checks, or reflects untrusted input in responses increases the risk of sensitive data exposure and insecure direct object references. The combination of Django’s flexible ORM-like cache patterns and DynamoDB’s schemaless storage can unintentionally preserve maliciously crafted entries, enabling account takeover or information leakage if remediation focuses only on the database layer and ignores cache-key integrity.

Remediation centers on strict input validation, canonical cache-key construction, and safe DynamoDB query patterns. Always treat input as untrusted, enforce allowlists for values used in cache keys and query expressions, and avoid reflecting raw user input in cached responses or DynamoDB attribute values.

1. Canonical cache keys and strict validation

Normalize inputs before using them in cache keys or DynamoDB key expressions. For integer-like identifiers, parse and re-format them to a consistent string form to prevent equivalent-but-different representations from creating distinct cache entries.

import hashlib
from django.core.cache import cache
def make_cache_key(base: str, user_id: str, page: int) -> str:
    # canonicalize: enforce integer, trim, lowercase where applicable
    clean_page = str(int(page))
    token = f"{base}:uid={user_id}:page={clean_page}"
    suffix = hashlib.sha256(token.encode("utf-8")).hexdigest()
    return f"api:{suffix}"

# Usage
key = make_cache_key("user_feed", "usr_123", page=1)
if (cached := cache.get(key)) is not None:
    return cached

2. Safe DynamoDB query construction with boto3

Use typed expressions and avoid string interpolation for attribute names or values. When filtering on user-provided fields, map them through an allowlist and use DynamoDB Placeholders to prevent injection-like behavior in expressions.

import boto3
from boto3.dynamodb.conditions import Key

dynamodb = boto3.resource("dynamodb", region_name="us-east-1")
table = dynamodb.Table("MyItems")

def get_items_for_user(user_id: str, status: str) -> list:
    # Allowlist validation
    allowed_status = {"active", "pending", "archived"}
    if status not in allowed_status:
        raise ValueError("Invalid status")

    response = table.query(
        KeyConditionExpression=Key("user_id").eq(user_id) & Key("status").eq(status),
        # Explicitly avoid ExpressionAttributeNames for fixed schemas unless necessary
    )
    return response.get("Items", [])

3. Avoid storing reflected or unsafe data in cache/DynamoDB

Do not persist raw query strings or user-controlled strings directly into DynamoDB attributes that influence later cache lookups. If you must store such data, enforce length limits and character checks, and treat cached entries as potentially hostile.

def safe_store_session(user_id: str, token: str):
    # Validate token format before storage
    if not re.match(r"^[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+\.?[A-Za-z0-9\-_]*$", token):
        raise ValueError("Invalid token format")
    table.put_item(Item={"user_id": user_id, "token": token, "ttl": int(time.time()) + 3600})

4. MiddleBrick and continuous monitoring

With the Pro plan, you can enable continuous monitoring and CI/CD integration so that cache-related regressions are caught before deployment. The GitHub Action can enforce a minimum security score and fail builds if input validation or data exposure findings appear. For rapid verification during development, the CLI allows on-demand scans from the terminal: middlebrick scan <url>.