A bypass technique for the Cloudflare WAF was discovered, allowing for XSS attacks without the use of parentheses. The payload used is ‘javascript:var{a:onerror}={a:alert};throw%20document.domain’. This bypass can be achieved by embedding the payload inside an anchor tag. This vulnerability allows an attacker to execute arbitrary JavaScript code on the target website, potentially leading to unauthorized access or data theft.
For more insights, check out the original tweet here: https://twitter.com/RootMoksha/status/1754062109128667147