Researchers Chain Cloudflare Flaws to Bypass CSP and Execute Malicious JavaScript
Multiple vulnerabilities in Cloudflare's image processing endpoint were chained by researchers to bypass Content Security Policy (CSP) and execute arbitrary JavaScript.
Security researchers have successfully chained several minor vulnerabilities within Cloudflare's image processing functionality to achieve a significant security bypass. The exploit targets the /cdn-cgi/image/ endpoint, a common feature used by websites leveraging Cloudflare's services for image optimization and transformation. By chaining weaknesses in XML parsing and cache control mechanisms, attackers can inject and execute malicious JavaScript on websites, even when Content Security Policy (CSP) is actively configured to prevent such script execution.
The technique, detailed by researchers Kevin Gervot and Adam Kues, exploits how Cloudflare processes SVG images using its svg-hush tool, which is built on the xml-rs library. While xml-rs typically escapes attribute values, it writes namespace values, such as xmlns, directly. This oversight allows an attacker to embed a quote mark within the namespace value, breaking out of the intended XML structure and enabling script injection. The vulnerability is particularly concerning because the malicious payload is approved by the filter before the escape is recognized.
Further complicating matters, the /cdn-cgi/image/ endpoint passes along Cache-Control headers from the original source image. Attackers can leverage a specific Cache-Control directive, no-cache="Content-Security-Policy", which instructs caches to drop the CSP header. While only Chromium-based browsers adhere to this specific rule, they are also susceptible to a cache-based bypass. After the initial load, the CSP is removed, and a subsequent browser action, such as navigating away and returning via history.back(), can trigger the browser to reload the cached, CSP-stripped version of the page, allowing the injected script to execute.
The researchers also explored other avenues for exploitation, including Cloudflare's Image Transformations feature. While this feature typically restricts image fetching to the current zone, it can be tricked into fetching from external sources if an open redirect vulnerability exists on an allowed site. However, the team found a method that bypasses the need for an open redirect. When Cloudflare Access is enabled on any hostname within a zone, the /cdn-cgi/access/logout endpoint can be manipulated. Its returnTo parameter accepts any cloudflare.com subdomain, allowing a redirect to an attacker-controlled file, thus completing the exploit chain even on zones with strict source settings.
The implications of this vulnerability chain are broad, affecting a significant portion of the internet that relies on Cloudflare for security and performance. The ability to bypass CSP, a critical defense mechanism against XSS attacks, opens the door for widespread cross-site scripting attacks on protected websites. This could lead to session hijacking, data theft, and the defacement of websites.
While the researchers did not immediately disclose a specific CVE or patch status, they emphasized the importance of reviewing security practices related to image processing and cache handling. They recommend that organizations avoid forwarding Cache-Control and X-* headers from untrusted sources, set X-Content-Type-Options: nosniff, and carefully review the sources their image processing tools are permitted to fetch from. The findings underscore the ongoing challenge of securing complex web infrastructure and the need for layered security defenses.
This research highlights how seemingly minor flaws, when chained together, can lead to critical security breaches. It serves as a reminder that even sophisticated security services like Cloudflare are not immune to complex exploit chains, and continuous vigilance and proactive security measures are essential for protecting web applications and user data.