Researchers Chain Cloudflare Security Flaws to Bypass CSP and Execute Malicious JavaScript

Security researchers at Searchlight Cyber chained several small weaknesses in Cloudflare’s image feature. The chain let them run JavaScript on a site that was meant to block it.

Kevin Gervot and Adam Kues published the work on October 28, 2026, in a write-up titled Cache Me If You Can. They showed a working cross-site scripting (XSS) bug through the /cdn-cgi/image/ endpoint on cloudflare.com. The write-up does not list a CVE or a patch status, so readers should check with Cloudflare.

Cloudflare XSS Flaws

Cloudflare sits in front of 24.3% of all websites. When a site joins Cloudflare, the company adds a managed /cdn-cgi/ path to that site’s own domain. Features such as bot checks, Web Analytics, Access, and Image Transformations live there.

Because these pages load from the customer’s own domain, a bug in them runs with that site’s trust. Other researchers had already found Content Security Policy (CSP) bypasses in this path. CSP is a browser rule set that limits which scripts a page may run.

Cloudflare cleans SVG images with svg-hush, a Rust tool built on the xml-rs library. The tool checks the file, then writes it back out. The researchers found that xml-rs escapes normal attribute values but writes namespace values (the xmlns setting) raw.

An attacker can hide a quote mark in that value and break out of it. The filter has already approved the file by then, so the script tag slips through. Cloudflare serves these images with a strict policy of default-src ‘none’, which blocks scripts. However, the endpoint passes along Cache-Control headers from the source image.

The HTTP rules allow a form such as no-cache=”Content-Security-Policy”, which tells a cache to drop the named header. Only Chromium follows this rule, and it accepts any header name. The CSP stays in place on the first load. After Chromium saves the page, the policy is gone.

A known CTF trick then forces Chromium to reload the saved copy. The attacker opens the page in a new window, moves that window to another site, and calls history.back().

The opener link keeps the page out of the back/forward cache, so Chromium uses its disk cache, and the script runs. A related cache-based CSP bypass covered earlier by Cyber Security News relied on the same bfcache fallback.

Image Transformations only fetches images from allowed sources. The default setting is “This zone only”. The fetcher follows redirects without checking the final address. Any open redirect on an allowed site therefore lets an attacker load an image from anywhere.

The team wanted a method that needed no open redirect. They found that once Cloudflare Access is on for any hostname in a zone, /cdn-cgi/access/logout works on every hostname in that zone. Its returnTo setting accepts any cloudflare.com subdomain.

A redirect on a Cloudflare research host then sent the fetcher to the attacker’s file. That completed the chain on zones with strict source settings. The team then tested the cache trick elsewhere. On Netlify Image CDN, they used it to drop both the CSP and the Content-Type header. Chromium then guessed the file type from its content and treated an SVG starting with a doctype as HTML.

A processing instruction hid the script from the SVGO cleaner, which only checks elements. The researchers say Netlify’s hosted code is not public, so they could not confirm it matches the open-source version. Amazon S3 and Google Cloud Storage also allow signed links to override response headers. Such links can set response-content-type and response-cache-control.

This matters for buckets behind custom domains or proxies that pass query strings along. The idea builds on earlier Content-Type override research and the S3 GetObject overrides.

The main lesson is that you shouldn’t trust only a file’s body. Headers passed through by an image service or storage layer become part of your security. Teams should avoid forwarding Cache-Control and X-* headers from untrusted sources.

They should also set X-Content-Type-Options: nosniff and review which sources their image tools may fetch. Closing open redirects helps too. Past work shows that even strong filters can fail, as in WAF bypass research on XSS payloads. Layered defenses still matter.

AI is making cyberattacks faster and cheaper. Are your defenses ready to respond at machine speed?

The post Researchers Chain Cloudflare Security Flaws to Bypass CSP and Execute Malicious JavaScript appeared first on Cyber Security News.