Critical Thinking - Bug Bounty Podcast

Episode 160: Cloudflare Zero-days & Mail Unsubscribing for XSS

Feb 5, 2026
They unpack a Cloudflare ACME zero-day that let WAF rules be bypassed. They explain how List-Unsubscribe headers can be weaponized into SSRF and stored XSS gadgets. Research on breaking Heroku Postgres multi-tenant isolation and parser MIME differentials that lead to cross-browser XSS gets discussed. A curious Claude ‘magic string’ denial-of-service and a mobile WebView-to-RCE chain are also covered.
Ask episode
AI Snips
Chapters
Transcript
Episode notes
ANECDOTE

Google VRP Swag Motivates Quick Hunts

  • Brandyn described Google's VRP swag bonus and his goal to get a bug before April for the swag.
  • Rez0 praised Google's hoodies and NVHs as some of his favorite bug bounty swag.
INSIGHT

ACME Challenge Can Nullify WAF

  • A Cloudflare ACME challenge misconfiguration allowed requests with valid challenge tokens to bypass WAF rules across tenants.
  • This exposed actuator endpoints and enabled secret disclosure and unauthenticated access to origin paths.
ADVICE

Probe List-Unsubscribe For SSRF/XSS

  • Test mail servers for support of the List-Unsubscribe header and inject non-standard URIs like javascript: or internal URLs.
  • Use blind XSS and SSRF payloads in that header to find stored XSS or server-side requests on mail platforms.
Get the Snipd Podcast app to discover more snips from this episode
Get the app