Web cache poisoning with an unkeyed header

web cache poisoning where an unkeyed X-Forwarded-Host is reflected into a script import url, so a poisoned home page response gets cached under the normal key and serves alert(document.cookie) to every visitor