Reflected XSS Flaw Enables Attackers to Evade Amazon CloudFront Protection Using Safari

A browser-specific reflected Cross-Site Scripting vulnerability was found on help-ads.target[.]com that could bypass Amazon CloudFront’s Web Application Firewall protections, but only when tested in the Safari browser. The bug bounty discovery showed that CloudFront blocked standard XSS payloads, yet certain Safari-specific URL reflection allowed the reflected JavaScript to execute.

Researchers demonstrated payloads such as a link with a JavaScript: alert and variants using inline event handlers and hexadecimal encoding, ultimately finding a payload that targeted how Safari interprets reflected content. The successful exploit could trick Safari users into running malicious scripts by clicking crafted links, potentially exposing cookies or other sensitive information.

The finder reported the issue to the platform owners before any real-world exploitation could occur, underscoring the need for testing across multiple browsers during security assessments. The piece also emphasises that defenders should not rely solely on WAFs, but ensure rigorous output encoding and sanitisation to address browser-specific behaviours.