Expected Findings
- `X-Forwarded-Host` is reflected into anchor and form action attributes.
- CDN cache key omits the header, so poisoned response is served to all clients.
- `Vary` does not include the relevant headers.
Edge Cache
Cache Poisoning
The CDN keys cache entries on URL only, but the origin reflects `X-Forwarded-Host` into the page body, so an attacker request poisons the cache for everyone else.
CWE-345
Cache audit
Primary Flows
- Cache audit Header set vs cache key
- Poisoned page Reflects X-Forwarded-Host
Signals
Bug
<a href="https://${X-Forwarded-Host}/login">Login</a>