Back to threat feeds
Vulnerability
Cloudflare Vulnerability Exposes Customer Websites to Attacks
Cloudflare's security services face a critical trust vulnerability. Explore how attackers exploit this gap, risking website protection.
Continue reading
Cloudflare's security services face a critical trust vulnerability. Explore how attackers exploit this gap, risking website protection.
Continue reading
Cloudflare, a prominent cybersecurity vendor renowned for its website protection services, has recently been scrutinized due to a vulnerability that threatens the security of customer websites. This Threatfeed delves into the technical intricacies of the vulnerability, its potential impact, and recommendations for mitigation.
Cloudflare offers a range of security services like Web Application Firewall (WAF), DDoS protection, and Bot management. These defenses operate via reverse-proxy servers placed between a customer's web server (the "origin server") and its users, allowing Cloudflare to inspect incoming traffic for threats.
The vulnerability arises when attackers manipulate the trust between Cloudflare and its customers by bypassing the protection mechanisms.
Cloudflare's documentation outlines various mechanisms to prevent attackers from overloading the origin server with malicious requests, encompassing layers of the OSI Model, including the Application Layer, Transport Layer, and Network Layer.
Two of these mechanisms, "Authenticated Origin Pulls" and "Allowlist Cloudflare IP addresses," rely on the assumption that all traffic originating from Cloudflare can be trusted, while traffic from other sources should be rejected. However, this assumption opens the door to exploitation.
"Authenticated Origin Pulls" is deemed "very secure" by Cloudflare. It involves using client SSL certificates to authenticate connections from Cloudflare's reverse proxy servers to the origin server. Customers are presented with two authentication options: a "Cloudflare certificate" or a custom certificate.
The issue arises when customers opt for the convenient Cloudflare certificate. This shared certificate permits all connections originating from Cloudflare, regardless of the specific Cloudflare tenant initiating the connection. An attacker can set up a custom domain with Cloudflare, point it to the victim's IP address, and turn off protection features, thereby circumventing security measures.
The "Allowlist Cloudflare IP addresses" mechanism, categorized as "moderately secure," instructs the origin server to reject any connection not originating from within Cloudflare's IP address ranges. Similar to Authenticated Origin Pulls, this mechanism fails to account for tenant-specific distinctions.
Attackers can exploit this by establishing a custom domain with Cloudflare, directing the DNS A record to the victim's IP address, and disabling protection features. Consequently, they can bypass the victim's configured security measures.
To illustrate the vulnerability, consider a scenario where a victim uses both "Authenticated Origin Pulls" with a Cloudflare Origin Certificate and "Allowlist Cloudflare IP addresses," as recommended by Cloudflare's official documentation. In contrast, the attacker sets up a domain without WAF protection, sharing the same origin IP address as the victim.
In this setup, an attacker can successfully send malicious requests to 203.0.113.42 via attacker.test, bypassing the victim's WAF configuration, while the same requests would be blocked when sent via victim.test.
This vulnerability underscores the importance of not relying solely on the "Allowlist Cloudflare IP addresses" mechanism for protecting origin servers. Instead, consider it as a defense-in-depth measure. When implementing "Authenticated Origin Pulls," opt for custom certificates over the shared Cloudflare certificate.
Additionally, explore alternative mechanisms for authenticating the Cloudflare tenant, as outlined in Cloudflare's documentation. These alternatives may involve trade-offs, such as running third-party code on sensitive webservers, but they provide a more robust defense against attacks.
A publicly accessible registration portal, a misconfigured Entra tenant, and no server-side authorization checks. That was enough to reach the systems controlling live World Cup streams
