Cache Pollution via Unkeyed GET Parameters on www.omise.co

The CDN serving appears to cache pages based on the full URL, including arbitrary query parameters, without normalizing or properly keying them. This allows an attacker to send requests with varying GET parameters to the same page (e.g., ) and cause each version to be cached separately, even if the …

This behavior results in cache pollution, where the cache is filled with redundant versions of the same page, potentially causing:

- Resource exhaustion on the CDN.

- Inconsistent user experience if malicious parameters affect rendering (e.g., error injection, redirect loops).

- Possibility for …