Assetnote researchers disclose XSS chain in Cloudflare's image endpoint
The chain combined an SVG sanitizer bypass, Chromium cache behavior and a Cloudflare Access redirect; Assetnote says it reported the issue and Cloudflare fixed it.
By Ryan Merket · Published
Primary source: x.com
Why it matters
The report shows how an image-optimization endpoint can become a security boundary when a sanitizer, browser cache and redirect behavior interact. Its documented conditions are specific, and the disclosure does not establish customer exposure or in-the-wild exploitation.
Security researchers at Assetnote disclosed a cross-site scripting vulnerability in Cloudflare's '/cdn-cgi/image/' endpoint on October 28th, describing a chain that bypassed the endpoint's SVG sanitization and Content Security Policy. Assetnote says it reported the issue to Cloudflare and that it has been fixed. The researchers' technical write-up says they reproduced the chain on 'www.cloudflare.com'.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.