How I Accidentally Found a ‘Cache Magic Trick’ — aka Unauthenticated PURGE on Varnish (Hold My…

Disclaimer: The names, logos, and entities are purely fictitious in this write-up. This is purely educational, and Varnish deserves a lot of love, no hate!

One sunny day, I’m sitting with my coffee running some security scans. (Nuclei scans, to be exact. Because you can’t be a cybersecurity enthusiast without a solid set of tools and a coffee for that strong, spicy mood). 💻☕

And boom, what do I see?

“Unauthenticated Cache Purge” on Varnish

🤔 What’s that? A cache vulnerability? Unauthenticated?
Yeh kya hai bhai? Just as I’d watched the [latest Bollywood villain hack into NASA], I knew this was my moment to uncover something sinister. 💀💻

So I thought, kya hi jaata hai, ek baar dekhte hain! Let’s just try a simple CURL command and see what happens:

curl -X PURGE https://target-website.com -v

I pressed enter… and suddenly, the site whispers back…

{
"status": "ok",
"id": "XXXXX"
}

🎉 Success! 🎉

Impact? Itna Bada Hai Ki Boss Will Call!

Now you may be thinking, “Yeh PURGE request kya bigaad sakta hai?” (What harm can a PURGE request do?) Here’s the breakdown in true Bollywood style:

Denial of Service (DoS) Potential:Think of Varnish cache like a hard-working coffee vendor — he serves everyone fast because he’s got his premade coffee ready. But if we keep telling him to throw away his coffee and make fresh every time? Bechara, he’ll just faint with exhaustion! 🥵 In this case, by sending repeated purge requests, Varnish throws the cache out the window, forcing the backend server to handle everything. As traffic grows, poor backend may just give up!Increased Latency (All That Lag, Bro!):Users waiting for Varnish’s fast response will instead face the slow backend — and bro, that’s like getting Saas-Bahu serial level delays! 😵‍💫 A few clicks, and users will leave the site faster than relatives leave when they see the bill.Attack Amplification:In our case, this attack can be automated. Imagine sending 1000 purge requests per minute — you’d be doing more damage than a cricket bat in a street fight! 🏏👊Business Impact (Bhai Log Will Not Be Happy):Think about it — slowdowns, user rage quits, backend under stress — this will burn a hole in their wallet! With bad user experience, their business will lose those precious rupees. 💸👋

So now that I’ve uncovered the villain’s plan, here are some very desi solutions:

Whitelist Trusted IPs Only: Only allow PURGE requests from trusted IPs. This way, only our trusted bhai log can clear the cache.Authentication for PURGE (No Access, No Stress!): Just add some auth (maybe an API token) to the PURGE endpoint. Kaam khatam!Rate-Limiting Purge Requests: Just in case, add a cap on PURGE requests per minute. Control, bhai, control!

In the end, it was a simple bug, but when left unchecked, itna bada ke boss bhi dar jaye. The takeaway? Even a minor bug like an unauthenticated cache purge can turn into a massive vulnerability if misused, making you go viral on Medium for all the wrong reasons!

And look, I may not be a pro, but I can still give you this pro advice: Keep scanning, keep learning, and hey — keep sipping that coffee! ☕