Security researchers from Searchlight Cyber have discovered a method to execute JavaScript on websites using Cloudflare, despite restrictions meant to prevent such actions. Their findings highlight vulnerabilities in Cloudflare’s image processing features that allow for the exploitation of security protocols.
Revealing the Vulnerabilities
Published by Kevin Gervot and Adam Kues on October 28, 2026, the report titled ‘Cache Me If You Can’ unveils a working cross-site scripting (XSS) vulnerability through Cloudflare’s /cdn-cgi/image/ endpoint. The documentation does not specify a CVE or indicate whether a patch is available, urging users to consult Cloudflare for updates.
Cloudflare, a major player in website security, integrates a managed /cdn-cgi/ path into the domains of participating sites. This path handles various functions, including image transformations, but its presence also enables potential security breaches.
How the Exploit Works
The researchers identified that Cloudflare’s SVG image processing tool, svg-hush, built on the xml-rs library, mishandles certain attribute values. While it escapes standard attributes, namespace values are not properly sanitized, allowing for the insertion of malicious code.
By exploiting this oversight, attackers can bypass the Content Security Policy (CSP) and insert script tags, even though Cloudflare enforces a strict default-source policy that typically blocks scripts. The vulnerability capitalizes on cache-control headers that Chromium browsers handle in a specific manner, leading to a failure in maintaining CSP on subsequent loads.
Broader Implications and Precautions
This method of bypassing security measures is not restricted to Cloudflare alone. Researchers replicated similar tactics on platforms like Netlify Image CDN, Amazon S3, and Google Cloud Storage. These services can inadvertently override security protocols through misconfigured headers.
The research underscores the importance of not solely relying on file content for security validation. Instead, headers must be carefully managed to prevent unauthorized access. Measures such as setting X-Content-Type-Options to nosniff and securing open redirects are crucial defensive strategies.
In conclusion, this research serves as a reminder of the complexities involved in web security. As cyber threats grow more sophisticated, particularly with the aid of AI, organizations must ensure that their defenses are robust and capable of operating at the speed of potential attacks.
