A bypass for the Cloudfront XSS WAF has been discovered. The payload used is 'alert = window["al"+"ert"]'. The bypass technique involves replacing spaces with '/', and encoding symbols like < as %3c, > as %3e, " as %22, [ as %5b, ] as %5d, and ` as %60. This bypass can potentially evade Cloudfront's XSS protection mechanisms. #bugbountytips #bugbounty
Original tweet: https://twitter.com/its_Loksh_P/status/1792006779783848407