arXiv subjects

Matteo Golinelli

Publications and source records attributed to Matteo Golinelli.

4 recordsLinked to original sources

arXiv2026

Web Cache Overflow: Exploiting Imprecise Keys for Cache Degradation and Beyond

Web caches support the scalability needs of contemporary web applications by storing frequently accessed objects closer to clients. Web caches are conceptually associative arrays, tracking stored objects using cache keys consisting of HTTP request fields. However, these cache keys are often imprecisely defined by website operators. This allows clients to craft a multitude of requests that target the same object, but map to different cache keys. In this work, we show that request elements included unnecessarily in cache keys can be abused to create redundant cache entries. In susceptible deployments, sustained generation of such redundant copies reduces cache effectiveness and increases origin load, facilitating eviction-dependent attacks. Our experiments reproduce cache degradation across five stand-alone caching proxies and characterize how these parameters affect attacker cost and cache hit rate, potentially resulting in denial-of-service attacks. We conclude that precise cache-key design is the most direct mitigation against this abuse vector and should be recognized as a security best practice.

cs.CR↗

arXiv2025

Koney: A Cyber Deception Orchestration Framework for Kubernetes

System operators responsible for protecting software applications remain hesitant to implement cyber deception technology, including methods that place traps to catch attackers, despite its proven benefits. Overcoming their concerns removes a barrier that currently hinders industry adoption of deception technology. Our work introduces deception policy documents to describe deception technology "as code" and pairs them with Koney, a Kubernetes operator, which facilitates the setup, rotation, monitoring, and removal of traps in Kubernetes. We leverage cloud-native technologies, such as service meshes and eBPF, to automatically add traps to containerized software applications, without having access to the source code. We focus specifically on operational properties, such as maintainability, scalability, and simplicity, which we consider essential to accelerate the adoption of cyber deception technology and to facilitate further research on cyber deception.

cs.CR↗

arXiv2024

Hidden Web Caches Discovery

Web caches play a crucial role in web performance and scalability. However, detecting cached responses is challenging when web servers do not reliably communicate the cache status through standardized headers. This paper presents a novel methodology for cache detection using timing analysis. Our approach eliminates the dependency on cache status headers, making it applicable to any web server. The methodology relies on sending paired requests using HTTP multiplexing functionality and makes heavy use of cache-busting to control the origin of the responses. By measuring the time it takes to receive responses from paired requests, we can determine if a response is cached or not. In each pair, one request is cache-busted to force retrieval from the origin server, while the other request is not and might be served from the cache, if present. A faster response time for the non-cache-busted request compared to the cache-busted one suggests the first one is coming from the cache. We implemented this approach in a tool and achieved an estimated accuracy of 89.6% compared to state-of-the-art methods based on cache status headers. Leveraging our cache detection approach, we conducted a large-scale experiment on the Tranco Top 50k websites. We identified a significant presence of hidden caches (5.8%) that do not advertise themselves through headers. Additionally, we employed our methodology to detect Web Cache Deception (WCD) vulnerabilities in these hidden caches. We discovered that 1.020 of them are susceptible to WCD vulnerabilities, potentially leaking sensitive data. Our findings demonstrate the effectiveness of our timing analysis methodology for cache discovery and highlight the importance of a tool that does not rely on cache-communicated cache status headers.

cs.CR↗

arXiv2023

The Nonce-nce of Web Security: an Investigation of CSP Nonces Reuse

Content Security Policy (CSP) is an effective security mechanism that prevents the exploitation of Cross-Site Scripting (XSS) vulnerabilities on websites by specifying the sources from which their web pages can load resources, such as scripts and styles. CSP nonces enable websites to allow the execution of specific inline scripts and styles without relying on a whitelist. In this study, we measure and analyze the use of CSP nonces in the wild, specifically looking for nonce reuse, short nonces, and invalid nonces. We find that, of the 2271 sites that deploy a nonce-based policy, 598 of them reuse the same nonce value in more than one response, potentially enabling attackers to bypass protection offered by the CSP against XSS attacks. We analyze the causes of the nonce reuses to identify whether they are introduced by the server-side code or if the nonces are being cached by web caches. Moreover, we investigate whether nonces are only reused within the same session or for different sessions, as this impacts the effectiveness of CSP in preventing XSS attacks. Finally, we discuss the possibilities for attackers to bypass the CSP and achieve XSS in different nonce reuse scenarios.

cs.CR↗