gmo-ierae/cve-2024-26144-testTest tool for CVE-2024-26144 that checks if web servers and CDNs improperly cache HTTP responses containing Set-Cookie headers, revealing cache misconfigurations.
Requirement:
$ deno run --allow-run --allow-net check.ts
If you want to test CDN, please set the URL in argument.
(Make sure all caches are purged before run!)
$ deno run --allow-run --allow-net check.ts https://example.com/
If HTTP response contains Set-Cookie header...
| Web server | Response cached (*1) | Cache contains Set-Cookie |
|---|
| Nginx + proxy_cache | NO | - |
| Nginx + Passenger | YES | YES |
| Apache + mod_cache | YES | YES |
| HAProxy | YES | YES |
| Cloudflare (Free plan) | NO | - |
| CloudFront (CachingOptimized) | YES | NO |
| CloudFront (UseOriginCacheControlHeaders) | NO | - |
| Fastly | NO | - |
*1 It is the result of whether the cache works for anonymous user. Even if it says NO, it may return cache for the request with same cookie.