Referer prefix bypass → XSS on an immutable.com origin

This page exists only to generate a Referer header. It is served from imx.community.inlandempirecci.org — a host created with a single DNS record under a domain the researcher controls. It has no relationship to imx.community.

The hotlink gate on image-resizer-cache.immutable.com tests the Referer with a case-insensitive string prefix, startsWith("https://imx.community"). This host's origin satisfies that prefix, so the click below passes the gate.

Chrome's default Referrer-Policy is strict-origin-when-cross-origin, which sends the origin only on a cross-origin navigation — exactly the part the prefix check reads. No Referrer-Policy header is set by this page.

Click here (simulates the victim following an attacker link)

What should happen

  1. The click sends Referer: https://imx.community.inlandempirecci.org/.
  2. CloudFront's prefix check passes; the Lambda fetches https://imx.community.inlandempirecci.org/poc.svg.
  3. That SVG is returned byte-for-byte as Content-Type: image/svg+xml, with no CSP, no Content-Disposition and no X-Content-Type-Options.
  4. It renders top-level, so its script executes in the image-resizer-cache.immutable.com origin. The rendered page states the origin it is running in.

Negative control

Open the same link from any host whose URL does not begin with https://imx.community — or paste it straight into the address bar, which sends no Referer at all — and CloudFront returns 403. The Referer prefix is the only thing that changes the outcome.

The payload is read-only: it reads location.origin and a cookie count, and makes no network requests. The count is 0 because hub.immutable.com's __session cookie is host-only and HttpOnly — this finding does not reach it.