Cache Poisoning in Axum

Cache poisoning occurs when an attacker manipulates shared caching mechanisms to store malicious responses that are then served to legitimate users. In Axum, this risk primarily emerges through improper use of caching middleware with public caches or misconfigured Cache-Control headers.

Axum, as a high-performance web framework built on Tower and Hyper, allows developers to define caching strategies using middleware like axum::middleware::Cache or third-party integrations. However, if caching is applied without proper validation of request parameters, attackers can poison caches by sending crafted requests that trigger divergent responses based on user-specific data.

For example, consider an endpoint that returns user-specific content but uses a shared cache key:

use axum::{routing::get, Router, http::Request, response::IntoResponse, Json};

async fn user_profile_handler(req: Request) -> impl IntoResponse {

    // Vulnerable: cache key based only on path, not on headers or cookies

    let cache_key = req.uri().path();

    // Simulated shared cache lookup

    if let Some(cached) = shared_cache.get(cache_key) {

        return Json(cached);

    }

    // Generate response based on authenticated user

    let user_id = extract_user_id_from_cookies(req.headers());

    let response_body = format!("{{ "user_id": "{}" }}", user_id);

    shared_cache.insert(cache_key, response_body.clone());

    Json(response_body)

}

An attacker can send a request with a cache key that matches a legitimate user's path but contains malicious content in a header or cookie that influences the response. Because the cache key does not include Cookie or Authorization headers, the attacker's response may be cached and served to other users.

Another vector involves misconfigured Cache-Control headers. If an endpoint unintentionally allows public caching of authenticated responses, attackers can exploit this by triggering the endpoint with a forged request that causes sensitive data to be cached.

This issue aligns with OWASP API Top 10 category A01:2023 - Broken Access Control, specifically Failure to enforce server-side authorization checks, and maps to CWE-529: Insufficient Encryption of Stored Data when sensitive data is improperly cached.