Researchers demonstrate XSS chain in Cloudflare image handler
Searchlight Cyber researchers demonstrated an XSS chain in Cloudflare's built-in image transformation handler (/cdn-cgi/image/), combining an svg-hush sanitizer bypass, a Chromium behavior involving the Cache-Control: no-cache directive, and an open redirect in Cloudflare Access. The same Cache-Control technique also worked on Netlify Image CDN and on object storage accessible via signed URLs. It is a research demonstration; the source reports no fix or in-the-wild exploitation.
What happened
Searchlight Cyber researchers demonstrated how to run code on sites using Cloudflare's built-in image handler (/cdn-cgi/image/). The attack chains three weaknesses: a bypassable SVG sanitizer, a Chromium behavior that drops the CSP security policy from cached responses, and an open redirect in Cloudflare Access. The same cache technique also worked on Netlify Image CDN and on object storage with signed URLs.
Why it matters
With XSS, an attacker can run scripts on the victim page and act as the user. The technique affects widely used CDN infrastructure, but the source reports only a research demonstration, with no in-the-wild exploitation. Companies serving images or SVGs through these paths should treat it as a risk.
What to do
Review whether the image handler follows redirects to outside destinations, whether responses can carry a Cache-Control header with the Content-Security-Policy no-cache directive, and whether the SVG sanitizer accepts malicious xmlns values. The source reports no fix, so mitigation depends on configuration and monitoring.
For the technical team
- Affected
- Manipulador de transformação de imagens embutido do Cloudflare (/cdn-cgi/image/); técnica também reproduzida no Netlify · Cloudflare's built-in image handler (/cdn-cgi/image/), including zones with Cloudflare Access; the same Cache-Control technique also worked on Netlify Image CDN and on object storage accessible via signed URLs. No versions cited in the source.
- Exploitation
- Demonstration by Searchlight Cyber researchers, disclosed via dbugs. The source reports no in-the-wild exploitation, no public repository PoC, and no KEV listing.
- Fix
- The source reports no fixed versions, patch, or official mitigation.
- Vector
- Cloudflare's built-in image transformation handler (/cdn-cgi/image/), in a three-part chain. 1) svg-hush sanitizer bypass: ordinary attribute values are escaped, but namespace declaration values are inserted unescaped during serialization; by abusing the xmlns value it is possible to break out of the attribute and inject script, which the sanitizer no longer checks. 2) CSP removal from the Chromium cache: Cloudflare forwards the Cache-Control header from the origin response; the no-cache="Content-Security-Policy" directive makes Chromium store the response body in the HTTP cache while excluding the CSP header from the cached copy; on subsequent navigation the page loads without the policy. 3) Image source restriction bypass: the /cdn-cgi/image/ loader follows redirects without checking whether the final destination is allowed; with Cloudflare Access enabled on any hostname in the zone, /cdn-cgi/access/logout accepts a returnTo parameter and allows redirects to subdomains, one of which contained an open redirect usable to reach the attacker-controlled domain.
- More details
- Chain steps described in the source: host an SVG that passes svg-hush but contains an embedded HTML element; host an image whose response includes the Cache-Control: no-cache="Content-Security-Policy" header, which Cloudflare forwards to the client; open the page in a new window, navigate to your own domain, and call history.back. The source text is truncated at that point, without detailing the rest of the step.
Timeline
Batch brings a Searchlight Cyber demonstration of a chained XSS in Cloudflare's image transformation handler.
Sources 1 source
- @ptdbugs @ptdbugs
