Massive Data Leak via Web Cache Deception

Censorship Note: All data (domains, paths, URIs, and variables) have been strictly anonymized using entirely fictional nomenclature (e.g., api.smart-home-platform.net). This report documents an indirect exfiltration of personal and IoT device information within a simulated environment to guarantee 100% privacy for the original enterprise.

This writeup details a critical Web Cache Deception (CWE-524) vulnerability discovered across the core API endpoints of an IoT/Smart Home device management platform.

Due to a severe misconfiguration between the Content Delivery Network (CDN) rules and the corporate origin server, an attacker was able to force the system to store any user's private information (emails, usernames, camera locations, and serial numbers) into the public cache, leaving it entirely exposed to the internet.

Vulnerability Analysis

In modern web architectures, CDNs are responsible for mitigating server load by statically storing "safe" and non-sensitive resources, such as images, CSS stylesheets, or JS scripts, to dispatch them rapidly to any visitor. Responses containing dynamic, user-personalized JSON should never be cached.