Generated by TLDR This:
Overview On August 24th, 2022, we reported a vulnerability to Netlify affecting their Next.js "netlify-ipx" repository which would allow an attacker to achieve persistent cross-site scripting and full-response server side request forgery on any website out of the box.
Methodology When approaching these sites as bug hunters with our understanding of how they have a different security model, we focused specifically on ways to compromise the integrity of the websites.
When this issue is paired with the default behavior for Next.js web servers whereby users are redirected when they try to access a folder which doesn’t exist, an attacker can make the HTTP response redirect to arbitrary websites.
Since the IPX functionality was open source, we began auditing the code and found this interesting snippet: netlify-ipx/index.ts const handler: Handler = async (event, _context) => { const host = event.headers.host const protocol = event.headers['x-forwarded-proto'] || 'http' When building the HTTP request sent out to fetch the optimized image, the server will default to sending “http” unless the protocol is otherwise specified through the “x-forwarded-proto” header.
The following code demonstrates that the “id” parameter (later used in sending the full HTTP request) plainly inserts our string that we’ve sent in the “x-forwarded-proto” header: netlify-ipx/index.ts const isLocal = !
This was great as well because, since the vulnerable component was built for image optimization, it had a great caching functionality which would cache the image based on the endpoint you loaded via the actual URI.
Jump in the discussion.
No email address required.
WHAAAAAAAAT!?!?!?!? IGNORE IT?!?! ARE YOU A MINORITY???? DO YO HAVE ANY IDEA HOW STUPID WHAT YOU JUST POSTED IS????
...I can barely calm down enough to explain that IGNORING IT didn't stop a shit ton of minorities from getting fricking murdered.
You think they were knocking on doors assaulting people when they were beat to death? Fricking NO!
Not for a FRICKING MOMENT will we let any of you think that this shit is ok for a FRICKING SECOND! THAT'S HOW WE WERE SO OPPRESSED TO BEGIN WITH YOU BUTTHOLE! We're we just supposed to wait for white people to treat us fairly?
Should we have waited before or after segregation. Remember segregation? Yhat lame butt plan to get us to shut the frick up?
Whoever you are, you don't know what the FRICK you're talking about so please shut the frick up on such sensitive matters.
We will, ALWAYS MAKE SURE, that it is well fricking known, that if they EVER try to put us back in that box, we will fricking fight. From every angle.
I don't condone violence, but I'll never, ever, let racist shit come with no consequence.
And you can thank America for my attitude.
Snapshots:
archive.org
archive.ph (click to archive)
ghostarchive.org (click to archive)
event.headers.host:
archive.org
archive.ph (click to archive)
ghostarchive.org (click to archive)
Jump in the discussion.
No email address required.
Th-thanks America
Jump in the discussion.
No email address required.
More options
Context
More options
Context