cve.bz

CAPEC-141

Cache Poisoning

High severityHigh likelihoodStandard pattern

An attacker exploits the functionality of cache technologies to cause specific data to be cached that aids the attackers' objectives. This describes any attack whereby an attacker places incorrect or harmful material in cache. The targeted cache can be an application's cache (e.g. a web browser cache) or a public cache (e.g. a DNS or ARP cache). Until the cache is refreshed, most applications or clients will treat the corrupted cache value as valid. This can lead to a wide range of exploits including redirecting web browsers towards sites that install malware and repeatedly incorrect calculations based on the incorrect value.

On this page

Ask an AI about this attack pattern

ChatGPTClaudeGoogle AI Mode

Show the promptExplain the attack pattern CAPEC-141: Cache Poisoning: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/141.html and https://cve.bz/cve/capec/141?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.

How the attack unfolds

  1. Explore

    The attacker looks for a way in.

    1. [Identify and explore caches] Use tools to sniff traffic and scan a network in order to locate application's cache (e.g. a web browser cache) or a public cache (e.g. a DNS or ARP cache) that may have vulnerabilities. Look for poisoning point in cache table entries.

      1 technique
      • Run tools that check available entries in the cache.

  2. Experiment

    They probe what they found.

    1. [Cause specific data to be cached] An attacker sends bogus request to the target, and then floods responses that trick a cache to remember malicious responses, which are wrong answers of queries.

      1 technique
      • Intercept or modify a query, or send a bogus query with known credentials (such as transaction ID).

  3. Exploit

    They carry out the attack.

    1. [Redirect users to malicious website] As the attacker succeeds in exploiting the vulnerability, they are able to manipulate and interpose malicious response data to targeted victim queries.

      2 techniques
      • Intercept or modify a query, or send a bogus query with known credentials (such as transaction ID).
      • Adversary-in-the-Middle attacks (CAPEC-94) intercept secure communication between two parties.

Prerequisites

  • The attacker must be able to modify the value stored in a cache to match a desired value.

  • The targeted application must not be able to detect the illicit modification of the cache and must trust the cache value in its calculations.

Skills required

  • Medium skill

    To overwrite/modify targeted cache

Mitigations

  • Configuration: Disable client side caching.

  • Implementation: Listens for query replies on a network, and sends a notification via email when an entry changes.

Weaknesses it exploits

  • CWE-345 Insufficient Verification of Data Authenticity
  • CWE-346 Origin Validation Error
  • CWE-348 Use of Less Trusted Source
  • CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data

Recent CVEs with these weaknesses

  1. 8.1CVE-2026-108187

    Origin Validation Error in Zoom Workplace for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.

  2. 7.4CVE-2026-120999

    Improper Authentication vulnerability in Google sign-in and email confirmation in nerves-hub nerves_hub_web allows an attacker who registers another person's email address to share that person's account once they sign in. NervesHub.Account…

  3. 8.1CVE-2026-123802

    SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, a licensed deployment with a configured SAML client can authenticate an identity from an assertion that did no…

  4. 7.4CVE-2026-123801

    SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, SAML.handleCallback does not consume RelayState, record assertion identifiers, or enforce Response.InResponseT…

  5. 8.1CVE-2026-115338

    Insufficient protection of communications in Progress WS_FTP Server versions prior to 2025.0.5 could allow a network attacker to intercept sensitive information or modify requests when unencrypted connections are used.

  6. 6.3CVE-2026-124249

    http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it, using the Domain and Path attributes from the header without consulting the cookie policy. A server could therefore delet…

  7. 6.3CVE-2026-123599

    Hickory DNS hickory-proto before 0.26.0-beta.1 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because verify_rrsets() ignores DNS class when partitioning RRsets, so non-IN records skip signature verification yet are marke…

  8. 8.7CVE-2026-123596

    Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recursor's NSEC handler that accepts parent-side ancestor-delegation NSEC records as proof of n…

The newest records naming one of them. Each weakness's page lists them all.

Part of
More specific patterns

Examples

In this example, an attacker sends request to a local DNS server to look up www.example .com. The associated …

In this example, an attacker sends request to a local DNS server to look up www.example .com. The associated IP address of www.example.com is 1.3.5.7.

Local DNS usually caches IP addresses and do not go to remote DNS every time. Since the local record is not found, DNS server tries to connect to remote DNS for queries. However, before the remote DNS returns the right IP address 1.3.5.7, the attacker floods local DNS with crafted responses with IP address 2.4.6.8. The result is that 2.4.6.8 is stored in DNS cache. Meanwhile, 2.4.6.8 is associated with a malicious website www.maliciousexampsle.com

When users connect to www.example.com, the local DNS will direct it to www.maliciousexample.com, this works as part of a Pharming attack.

MITRE's words, unchanged: CAPEC-141 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.