Bypassing Cloudflare WAF to Trigger Reflected XSS on a Major Health Information Platform

Overview

While testing the search functionality of a major consumer-facing health information website, I discovered a Reflected Cross-Site Scripting (XSS) vulnerability. Though protected by Cloudflare's Web Application Firewall (WAF), I was able to bypass its filtering using malformed attributes and a null byte injection, leading to successful script execution in the browser.

Background

The platform is among the most visited health portals globally, publishing online news and information about human health, wellness, and medications. It is secured by Cloudflare, a widely used CDN and WAF provider. Given the platform's massive reach and trust among its users, any XSS vulnerability has significant security implications.

Initial Attempts: Blocked by WAF

I started testing with a common XSS payload:

"><svg onload=alert(document.domain)>+x>

"><svg onload=alert(document.domain)>+x>

This was injected into a search query parameter and sent as part of a GET request. However, the WAF immediately blocked it, returning a 403 Forbidden response. This is illustrated in the screenshot below:

WAF Blocked the Request (403 Forbidden)

Response Details:

Status: 403 Forbidden

Server: cloudflare

Behavior: Request terminated before reaching the origin server

The browser didn't render anything — Cloudflare intercepted the request at the edge.

WAF Bypass Using Null Byte and Malformed Attribute

To bypass the WAF, I crafted a modified payload by introducing a fake attribute (onx) and injecting a null byte (%00) to break WAF parsing logic:

This was encoded and passed as:

"><svg+onx+%00+onload%3Dalert(document.domain)+x>

"><svg+onx+%00+onload%3Dalert(document.domain)+x>

This time, the WAF did not block the request. The browser rendered the SVG tag, ignored the fake onx attribute, and executed the onload JavaScript event.

Upon visiting the page with the bypass payload, the script executed successfully and triggered an alert popup with the current domain, confirming XSS

Why This Bypass Works

This bypass is effective because of how different systems parse malformed input:

**WAF (Cloudflare)**Fails to fully parse the payload due to the null byte (%00) and onx, prematurely terminates analysis. Ignores invalid attributes (onx), skips %00, and processes the valid onload attribute normally