Collected research
Cloudflare Image Proxy as a CSPT Gadget: A Cross-Origin CSPT Exploit
A client-side path traversal is normally confined to the origin hosting the vulnerable fetch. Chaining it to a gadget that answers with a 307 or 308 redirect, such as an image transformation endpoint, preserves method and body and moves the request to a chosen sibling subdomain, letting the attacker reach sensitive APIs there.
Record
- Researcher
- Amirmohammad Safari
- Published by
- Voorivex Team
- Date
- Topic
- XSS
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Amirmohammad Safari, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .