I am recently exploring and playing with James Kettle's Practical Web Cache Poisoning attack. The last part of his post mentioned that Cross-Cloud Poisoning is possible, however, I can't find a way to make it work.
I think the basic idea is to cURL a request with malicious header to a specific edge server by its IP address, however, Cloudflare uses Anycast among their data centers, which means you can't control which data center you will eventually reach even though you cURL to a specific IP address.
I made quite a few tries at my home, and I found no matter what IP address I cURL to, I was always routed to the closest data center around me.
I wonder if I have missed anything, and if it is really possible to remotely poisoning a data center?