EN PT-BR
← Voltar ao feed
medium

Researchers chain Cloudflare Image Transformations svg-hush flaw, Chromium cache quirk and redirects to bypass CSP and run same-origin XSS

1 fonte(s) · 1 atualização(ões) · publicado 29/10/2026 03:18 · coletado há 3 dias

Researchers Kevin Gervot and Adam Kues published an attack chain on October 28, 2026 against Cloudflare Image Transformations (/cdn-cgi/image/). It bypasses SVG sanitization and Content Security Policy (CSP) to execute attacker-controlled JavaScript on a customer's own origin. The chain combines an XML serialization flaw in svg-hush/xml-rs, a Chromium cache behavior and redirect handling that sidesteps image-source restrictions. They demonstrated XSS on Cloudflare's own website. Exploitation depends on specific configurations and browser navigation conditions, so not every customer is affected. The report gives no CVE, remediation timeline or evidence of in-the-wild exploitation.

Entenda a falha

A vulnerabilidade

Researchers Kevin Gervot and Adam Kues chained several weaknesses in Cloudflare Image Transformations (the /cdn-cgi/image/ endpoint served from customer hostnames) to run attacker-controlled JavaScript on the customer's own origin. The chain combines an escaping flaw in svg-hush and xml-rs, a Chromium cache behavior and a redirect-following image fetcher. The attacker needs to get a victim to follow a navigation in Chromium, and the setup depends on configuration (permissive image sources, or Cloudflare Access enabled on a hostname in the zone). The result is same-origin XSS. No CVE, affected or fixed versions are given.

Como funciona

The service fetches an SVG from a source, sanitizes it with svg-hush and serializes it through xml-rs, then serves it under a restrictive CSP such as default-src 'none'. Namespace declaration URIs take a separate serialization path and are written without escaping, so encoded markup in the default namespace declaration becomes a script element after sanitization finished. The CSP still blocks it at first. Cloudflare forwards the origin's Cache-Control header, and a no-cache directive naming Content-Security-Policy makes Chromium drop that header from the cached copy while keeping the body. When the browser later reloads the response from the HTTP cache, the script runs without CSP. Separately, the fetcher follows redirects without rechecking the destination, which lets an attacker-hosted SVG be fetched even when sources are restricted.

Por que é vulnerável

There are several root causes. In xml-rs, namespace declaration URIs were not escaped like ordinary attribute values, so sanitized output could be altered at serialization time. Cloudflare trusted and forwarded origin-supplied Cache-Control as if it were harmless, though it can change browser enforcement of CSP. Chromium applies the selective no-cache header by removing CSP from cached responses (Firefox and Safari were not affected). The image fetcher followed redirects without rechecking the destination origin. The articles describe no fix; the researchers' lesson is that response metadata must be treated as part of the same security boundary as the document.

Onde está

The articles name the svg-hush sanitizer and the xml-rs serialization of namespace declarations, plus the /cdn-cgi/image/ endpoint and the Cloudflare Access logout endpoint, but give no file, function or commit.

Como foi descoberta

The chain was found and published on October 28, 2026 by researchers Kevin Gervot and Adam Kues in a technical analysis, with a demonstrated XSS on Cloudflare's own website. The articles do not say how the research began, whether Cloudflare was notified beforehand, or whether a fix exists. No CVE, remediation timeline or in-the-wild exploitation is reported. The researchers also extended the cache primitive to Netlify Image CDN and publicly readable S3 objects under specific conditions.

Explicação gerada por IA a partir da matéria e dos artigos, em 29/10/2026 05:18.

Detalhes técnicos

  • Sanitizer bypass: in svg-hush (Cloudflare's Rust SVG sanitizer) and xml-rs, namespace declaration URIs were serialized without the escaping applied to ordinary attributes. A prefixed SVG root satisfied namespace validation while encoded markup in the default namespace declaration became an injected script element after sanitization.
  • CSP removal: Cloudflare's restrictive CSP (e.g. default-src 'none') initially blocked execution. Cloudflare forwards origin-supplied Cache-Control headers, so Cache-Control: no-cache="Content-Security-Policy" makes Chromium drop the CSP header from the cached response while keeping the body. Firefox and Safari were not affected.
  • Cache reuse trigger: the demo opened a new window, navigated it to an attacker page and called history.back(). The retained window.opener relationship prevented bfcache restoration and forced an HTTP-cache reload without CSP. This differs from earlier cache-based CSP bypasses that reused a leaked nonce.
  • Restricted image sources: the image fetcher followed redirects without rechecking the destination origin. Where Cloudflare Access was enabled on any hostname in a zone, its logout endpoint could be chained with an open redirect on a Cloudflare research subdomain to fetch an attacker-hosted SVG. Permissive image-source settings made exploitation simpler.
  • Wider impact: the cache primitive was extended to Netlify Image CDN and publicly readable S3 objects under specific conditions.

Remediação

The article states no patch or timeline. Its guidance is that image proxies and storage integrations must treat forwarded response metadata (such as Cache-Control) as part of the same security boundary as the fetched document, since sanitizing content alone is insufficient. Defenders should review Image Transformations source restrictions and exposure of Cloudflare Access redirect paths.

Linha do tempo

  1. gbhackers.com ↗ · pub. 29/10/2026 03:18 · coletado 29/10 05:00 primeiro registro

    Researchers chain Cloudflare Image Transformations svg-hush flaw, Chromium cache quirk and redirects to bypass CSP and run same-origin XSS

    ler a análise desta fonte

    Researchers Kevin Gervot and Adam Kues published an attack chain on October 28, 2026 against Cloudflare Image Transformations (/cdn-cgi/image/). It bypasses SVG sanitization and Content Security Policy (CSP) to execute attacker-controlled JavaScript on a customer's own origin. The chain combines an XML serialization flaw in svg-hush/xml-rs, a Chromium cache behavior and redirect handling that sidesteps image-source restrictions. They demonstrated XSS on Cloudflare's own website. Exploitation depends on specific configurations and browser navigation conditions, so not every customer is affected. The report gives no CVE, remediation timeline or evidence of in-the-wild exploitation.

    Technical Details

    • Sanitizer bypass: in svg-hush (Cloudflare's Rust SVG sanitizer) and xml-rs, namespace declaration URIs were serialized without the escaping applied to ordinary attributes. A prefixed SVG root satisfied namespace validation while encoded markup in the default namespace declaration became an injected script element after sanitization.
    • CSP removal: Cloudflare's restrictive CSP (e.g. default-src 'none') initially blocked execution. Cloudflare forwards origin-supplied Cache-Control headers, so Cache-Control: no-cache="Content-Security-Policy" makes Chromium drop the CSP header from the cached response while keeping the body. Firefox and Safari were not affected.
    • Cache reuse trigger: the demo opened a new window, navigated it to an attacker page and called history.back(). The retained window.opener relationship prevented bfcache restoration and forced an HTTP-cache reload without CSP. This differs from earlier cache-based CSP bypasses that reused a leaked nonce.
    • Restricted image sources: the image fetcher followed redirects without rechecking the destination origin. Where Cloudflare Access was enabled on any hostname in a zone, its logout endpoint could be chained with an open redirect on a Cloudflare research subdomain to fetch an attacker-hosted SVG. Permissive image-source settings made exploitation simpler.
    • Wider impact: the cache primitive was extended to Netlify Image CDN and publicly readable S3 objects under specific conditions.

    Remediation

    The article states no patch or timeline. Its guidance is that image proxies and storage integrations must treat forwarded response metadata (such as Cache-Control) as part of the same security boundary as the fetched document, since sanitizing content alone is insufficient. Defenders should review Image Transformations source restrictions and exposure of Cloudflare Access redirect paths.