Cloudflare Image Transformation Flaws Chained to Bypass CSP and Execute JavaScript

Searchlight Cyber researchers Kevin Gervot and Adam Kues demonstrated same-origin cross-site scripting through Cloudflare’s /cdn-cgi/image/ endpoint on cloudflare.com by chaining an SVG sanitization weakness, Chromium cache behavior, and redirects involving Cloudflare Access. Unsafe SVG namespace serialization enabled executable content, while attacker-controlled cache directives caused Chromium to omit the Content-Security-Policy header when restoring a response from its HTTP cache. Redirects bypassed image-source restrictions, allowing the combined chain to execute JavaScript despite a restrictive CSP. The reports provide no CVE identifier or confirmed patch status and do not describe exploitation in the wild.

The researchers also demonstrated a related attack against Netlify Image CDN, stripping both CSP and Content-Type headers so Chromium interpreted an SVG/HTML polyglot as executable HTML. They showed how signed response-header overrides for publicly readable Amazon S3 objects could combine an HTML content-type override with CSP removal; Google Cloud Storage signed-link overrides were identified as another potential exposure path under specific deployment conditions. The findings highlight risks from forwarding attacker-controlled headers through image-processing and object-serving services. Defenders should restrict forwarded and overridable response headers, enforce X-Content-Type-Options: nosniff, review permitted image sources and redirect handling, and eliminate open redirects.