nuclei-templates/http/misconfiguration/cloudflare-rocketloader-htmli.yaml

id: cloudflare-rocketloader-htmli

info:
  name: Cloudflare Rocket Loader - HTML Injection
  author: j3ssie
  severity: low
  description: |
    The Rocket Loader feature in Cloudflare allow attackers to inject arbitrary HTML into the website. This can be used to perform various attacks such as phishing, defacement, etc.
  remediation: Disable the rocket loader or Add a CSP header to fix this issue.
  reference:
    - https://developers.cloudflare.com/speed/optimization/content/rocket-loader/enable/
    - https://developers.cloudflare.com/fundamentals/reference/policies-compliances/content-security-policies/#product-requirements
  metadata:
    verified: true
    max-request: 1
  tags: misconfig,cloudflare,htmli

http:
  - method: GET
    path:
      - "{{BaseURL}}/cdn-cgi/image/width=1000,format=auto/https://raw.githubusercontent.com/simple-icons/simple-icons/develop/icons/cloudflare.svg"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'Cloudflare'
          - '<svg'
          - 'M16.5088 16.8447c.1475-.5068.0908-.9707-.1553-1.3154-.2246-.3164-.6045-.499-1.0615-.5205l-'
          - '1475.5068-.0918.9707.1543 1.3164.2256.3164.6055.498'
        condition: and

      - type: word
        part: header
        words:
          - 'image/svg+xml'

      - type: status
        status:
          - 200
# digest: 490a004630440220078dae8c97372b931bd7435693b67c204a81c9411fcbe20e1fc657d63704bdff02200cc52e3711d11352ce0f241c9cc79a6371d05c0070ec19166837dfcea4382ead:922c64590222798bb761d5b6d8e72950