Executive brief
Netlify IPX is an image processing library used to optimize and transform images on web applications. A flaw in host validation and cache handling allows attackers to bypass domain allowlists by sending specially crafted headers, causing arbitrary images to be loaded and served globally to all visitors. By requesting malicious SVG files, attackers can achieve stored XSS attacks that execute scripts in the context of the application's domain.
Technical details
The vulnerability arises from improper host validation in @netlify/ipx versions before 1.2.3, which fails to properly validate the source domain allowlist when processing HTTP headers. An attacker can send crafted headers to set an arbitrary image URL independently of the request URL, bypassing the domain restrictions. Because the response is cached globally, the poisoned cache is served to all subsequent visitors without additional headers. XSS can be achieved via malicious SVG payloads with embedded scripts, which execute when served from the application's own domain. The vulnerability is network-accessible, requires no authentication, but does require user interaction (visiting a page that loads the poisoned cached content). A patch is available in version 1.2.3.
Affected products
- Netlify IPX before 1.2.3
Timeline
- 2022-09-21: disclosed
- 2022-09-21: patched: Version 1.2.3 released