Cache Pollution via Unkeyed GET Parameters on www.omise.co

The CDN serving www.omise.co appears to cache pages based on the full URL, including arbitrary query parameters, without normalizing or properly keying them. This allows an attacker to send requests with varying GET parameters ?test=123, ?abc=xyz, etc. to the same page (e.g., /en/contact-sales) and cause each version to be cached separately, even if the page content is identical.

This behavior results in cache pollution, where the cache is filled with redundant versions of the same page, potentially causing:

• Resource exhaustion on the CDN.

• Inconsistent user experience if malicious parameters affect rendering (e.g., error injection, redirect loops).

• Possibility for future Web Cache Poisoning if a parameter is reflected in the response.