Serious vulnerability in CloudFlare that allows your WAF to be disabled

guest · Oct 26, 2018

Serious vulnerability in CloudFlare that allows your WAF to be disabled
October 25, 2018
https://opendatasecurity.io/cloudflare-vulnerability-allows-waf-be-disabled/

A WAF is a service that analyzes and filters all HTTP requests to a web application. Also, a WAF blocks any request identified as malicious, and allows the rest.

In order to separate malicious requests from legitimate ones, a WAF analyzes the different parts of a request to a web resource. Some of those parts are headers, parameters and body of the query, among others.
Vulnerabilities of WAF’s
[...] no matter how effective a WAF is in detecting attacks, there is certain data that is invisible to its analysis. If the parameters that contain malicious data are outside the scope to which the WAF has access, it will be totally unusable.
Vulnerabilities, also in paid WAF services
CloudFlare and Cloudbric are two well-known suppliers [...] we found the same vulnerability in the products that both companies sell.
[...] the CloudFlare WAF is not able to detect and block the malicious request when adding more parameters
Click to expand...

Log in or Sign up

Serious vulnerability in CloudFlare that allows your WAF to be disabled

guest Guest

Log in or Sign up

Serious vulnerability in CloudFlare that allows your WAF to be disabled

guest Guest

Useful Searches