Summary
When using Astro's Cloudflare adapter (@astrojs/cloudflare) with output: 'server', the image optimization endpoint (/_image) contains a critical vulnerability in the isRemoteAllowed() function that unconditionally allows data: protocol URLs. This enables Cross-Site Scripting (XSS) attacks through malicious SVG payloads, bypassing domain restrictions and Content Security Policy protections.
Details
On-demand rendered sites built with Astro include an /_image endpoint for image optimization. While this endpoint is designed to restrict processing to local images and authorized remote domains (configured via image.domains or image.remotePatterns), a critical vulnerability exists in the underlying validation logic.
The isRemoteAllowed() function in packages/internal-helpers/src/remote.ts (lines 128-131) unconditionally allows ALL data: protocol URLs without any validation or sanitization. When combined with SVG images containing JavaScript, this creates a vector for XSS attacks.
Vulnerable Code:
/packages/ packages/internal-helpers/src/remote.ts lines 128-131
if (url.protocol === 'data:') {
return true; // ← Unconditionally allows ALL data: URLs!
}The vulnerability manifests differently depending on the image endpoint implementation:
- Safe implementation: Server processes SVG and converts to raster format (PNG/JPEG), removing JavaScript
- Vulnerable implementation: Server redirects browser to raw SVG data URL, allowing JavaScript execution
PoC
-
Create a new minimal Astro project (astro@latest)
-
Configure it to use the Cloudflare adapter (@astrojs/[email protected])
-
Deploy to Cloudflare Pages or Workers.
-
Write page to load SVG Image like : SVG XSS Payload
-
Open directly the SVG file to show an alert (in read scenarios, the apps that use the framework will use CDN for example, to load SVG, depending that the framework is secure)
Impact
- XSS: Malicious URLs can be crafted to execute JavaScript in victim's browser
- Session Hijacking: JavaScript can access cookies and session tokens
- Account Takeover: Combined with CSRF, can perform unauthorized actions
- Data Exfiltration: Sensitive information can be stolen and sent to attacker-controlled servers
References
References
zomaxsec Reporter
Summary
When using Astro's Cloudflare adapter (@astrojs/cloudflare) with
output: 'server', the image optimization endpoint (/_image) contains a critical vulnerability in theisRemoteAllowed()function that unconditionally allowsdata:protocol URLs. This enables Cross-Site Scripting (XSS) attacks through malicious SVG payloads, bypassing domain restrictions and Content Security Policy protections.Details
On-demand rendered sites built with Astro include an
/_imageendpoint for image optimization. While this endpoint is designed to restrict processing to local images and authorized remote domains (configured viaimage.domainsorimage.remotePatterns), a critical vulnerability exists in the underlying validation logic.The
isRemoteAllowed()function in packages/internal-helpers/src/remote.ts (lines 128-131) unconditionally allows ALLdata:protocol URLs without any validation or sanitization. When combined with SVG images containing JavaScript, this creates a vector for XSS attacks.Vulnerable Code:
The vulnerability manifests differently depending on the image endpoint implementation:
PoC
Create a new minimal Astro project (astro@latest)
Configure it to use the Cloudflare adapter (@astrojs/[email protected])
Deploy to Cloudflare Pages or Workers.
Write page to load SVG Image like : SVG XSS Payload
Open directly the SVG file to show an alert (in read scenarios, the apps that use the framework will use CDN for example, to load SVG, depending that the framework is secure)
Impact
References
References