CVE-2022-39239 Details

A vulnerability in netlify-ipx, an on-demand image optimization tool for Netlify, allows attackers to bypass the source image domain allowlist in versions prior to 1.2.3. By sending specially crafted headers, an attacker can manipulate the handler into loading and returning arbitrary images. These images are globally cached and subsequently served to visitors without the need for the original headers. This vulnerability can be exploited to achieve cross-site scripting (XSS) by requesting a malicious SVG containing embedded scripts, which would then be delivered from the site domain. However, this does not affect images displayed in `<img>` tags, as scripts do not execute in that context. The vulnerability arises because the image URL can be specified in the header, independently of the request URL, allowing for cache poisoning of any site images that have not been previously cached.

This vulnerability has been fixed in netlify-ipx version 1.2.3. For users on Netlify, the issue is no longer exploitable as the CDN now sanitizes the relevant headers. Cached content can be cleared by redeploying the site.