Netlify vulnerable to XSS SSRF attacks via cache poisoning
23-Sep-22
Any supported website could be subject to full-response server-side request forgery or persistent cross-site scripting (XSS) through a vulnerability in Netlify. Researchers discovered that Netlify had a cache poisoning vulnerability that made it vulnerable to XSS attacks.
The security weakness, identified as CVE-2022-39239, allowed an attacker to load and return any image by tricking the handler into loading it by delivering specially crafted headers that overrode the source image domain allowlist. Read More…
