XSS via Cloudflare /cdn-cgi/image/ by stripping CSP with Cache-Control no-cache
The claim
The authors claim that an attacker can achieve cross-site scripting on any site using Cloudflare’s /cdn-cgi/image/ endpoint by exploiting an SVG sanitization bug and a Chromium Cache-Control no-cache header to remove CSP and Content-Type.
Published as: “Cache Me If You Can: XSS in Cloudflare's /cdn-cgi/image/”
So what
A seemingly harmless cache directive can turn image-optimization services into a same-origin XSS vector, even when strict CSPs are in place.
The five-minute version
The researchers discovered a serialization bug in the svg-hush sanitizer that allows injection of a malicious xmlns attribute. They then leveraged Chromium’s unique handling of Cache-Control: no-cache="<field-name>" to strip the Content-Security-Policy header from the cached response, bypassing a restrictive CSP. By chaining this with a Cloudflare Access logout redirect, they delivered the payload even under restrictive image source configurations. The attack was demonstrated on Cloudflare’s own domain and extended to Netlify Image CDN and S3 signed URLs, showing the broader impact.
What they found 3
- Cache-Control: no-cache="Content-Security-Policy" strips CSP in Chromium’s HTTP cache
“Cache-Control: no-cache="Content-Security-Policy"”
- Only Chromium implements the selective-header Cache-Control behavior
“Chromium was the only one that implemented this selective-header behavior.”
- svg-hush serializes namespace URIs without escaping, enabling attribute break-out
“During serialization, emit_current_namespace_attributes inserted their URI values directly into the output without escaping.”
What undercuts it the paper’s own results
- Chromium was the only browser that implemented the selective-header Cache-Control behavior, so the attack does not work in Firefox or Safari.
Stated limits 2
- Chromium was the only one that implemented this selective-header behavior.
- The attack requires the victim to use Chromium and to have the vulnerable Cache-Control handling.
What’s new here 4
- Identified an SVG sanitization bypass in Cloudflare's svg-hush library via unescaped namespace serialization.
- Exploited Chromium’s selective Cache-Control header exclusion to remove CSP (and later Content-Type) from cached responses.
- Combined the above with a Cloudflare Access logout open-redirect to bypass image source restrictions.
- Showed that the same primitive works on Netlify Image CDN and S3 signed URLs, broadening the attack surface.
Artifacts & methods 6
- svg-hushprimitive
- /cdn-cgi/image/ endpointsystem
- Cloudflare Access /logout redirectprimitive
- Chromium Cache-Control no-cache field-name handlingtheory
- Netlify Image CDNevaluation
- AWS S3 signed URL with response-content-type and response-cache-controlevaluation