Unauthenticated cache purging

How it was found

Summary:

I found a vulnerability in https://fanout.io/ page known as unauthenticated cache purging vulnerability. This vulnerability arises when cache purging requests are available to the unauthenticated users.

Steps To Reproduce:

1. Go to any terminal of an OS which has curl installed in it.
2. Type in the following command curl --head https://fanout.io/ and hit enter. You will see that there are these following HTTP headers available

via: 1.1 varnish
age: 7
x-served-by: cache-qpg1234-QPG
x-cache: HIT
x-cache-hits: 1

3. This means that the page is caching the requests. So to reproduce the bug or to exploit it, type curl -X PURGE https://fanout.io/ and in the response you'll see { "status": "ok", "id": "1237-1678993092-222436" } (the id can be changed in your case) This response proves that this endpoint is vulnerable to unauthenticated cache purging.

Supporting Material/References:

F2235408

Impact

In general, cache purging vulnerabilities can have a high severity level because they can allow an attacker to manipulate the cache of a web application, which can lead to various types of attacks such as website defacement, unauthorized access to sensitive data, or denial of service (DoS) attacks.