Cloudflare Worker SSRF: Malicious Content Can Be Served Through Your Site

Summary

A vulnerability in Cloudflare Workers allows attackers to serve malicious content through your site, bypassing security protections. This could lead to user confusion or other security issues. To protect your site, update the @opennextjs/cloudflare package to the latest version, and ensure that you're using a secure development environment to prevent accidental exposure of sensitive paths.

What to do

Update opennextjs cloudflare to version 1.17.1.

Affected software

Vendor	Product	Affected versions	Fix available
opennextjs	cloudflare	<= 1.17.1	1.17.1
opennextjs	opennext_for_cloudflare	<= 1.17.1	–

Original title

A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package, resulting from a path normalization bypass in the /cdn-cgi/image/ handler.The @opennextjs/cl...

Original description

A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package, resulting from a path normalization bypass in the /cdn-cgi/image/ handler.The @opennextjs/cloudflare worker template includes a /cdn-cgi/image/ handler intended for development use only. In production, Cloudflare's edge intercepts /cdn-cgi/image/ requests before they reach the Worker. However, by substituting a backslash for a forward slash (/cdn-cgi\image/ instead of /cdn-cgi/image/), an attacker can bypass edge interception and have the request reach the Worker directly. The JavaScript URL class then normalizes the backslash to a forward slash, causing the request to match the handler and trigger an unvalidated fetch of arbitrary remote URLs.

For example:

https://victim-site.com/cdn-cgi\image/aaaa/https://attacker.com

In this example, attacker-controlled content from attacker.com is served through the victim site's domain (victim-site.com), violating the same-origin policy and potentially misleading users or other services.

Note: This bypass only works via HTTP clients that preserve backslashes in paths (e.g., curl --path-as-is). Browsers normalize backslashes to forward slashes before sending requests.

Additionally, Cloudflare Workers with Assets and Cloudflare Pages suffer from a similar vulnerability. Assets stored under /cdn-cgi/ paths are not publicly accessible under normal conditions. However, using the same backslash bypass (/cdn-cgi\... instead of /cdn-cgi/...), these assets become publicly accessible. This could be used to retrieve private data. For example, Open Next projects store incremental cache data under /cdn-cgi/_next_cache, which could be exposed via this bypass.

nvd CVSS4.0 7.7

Vulnerability type

CWE-706

CWE-918 Server-Side Request Forgery (SSRF)