PT-2022-21776 · Cloudflare · Cloudflare Warp

Name of the Vulnerable Software and Affected Versions: Cloudflare WARP mobile client affected versions not specified Description: The issue allowed a user to delete a VPN profile from the WARP mobile client on the iOS platform, despite the Lock WARP switch feature being enabled on the Zero Trust...

Cloudflare WARP 数据伪造问题漏洞

Cloudflare WARP Cloudflare Vpn is a client application for secure connectivity from Cloudflare, Inc. A security vulnerability exists in the Cloudflare WARP Zero Trust platform that stems from insufficient policy validation in the WARP iOS client, which allows an attacker to bypass the Lock Warp...

Cloudflare OctoRPKI 安全漏洞

Cloudflare OctoRPKI is an RPKI toolkit for the Cloudflare platform from Cloudflare, Inc. in the United States. A security vulnerability exists in Cloudflare OctoRPKI. An attacker exploiting this vulnerability could create an overly long CA chain, causing OctoRPKI to exceed its maximum iteration...

Link Preload XSS

Description Link preloads do not effectively confirm if the requested link is external. Parser differentials can be used to bypass existing external URL check. Root Cause payload.client.ts contains the following code on link prefetch: ts nuxtApp.hooks.hook'link:prefetch', url = if...

Mirai Botnet Hits Wynncraft Minecraft Server with 2.5 Tbps DDoS Attack

Web infrastructure and security company Cloudflare disclosed this week that it halted a 2.5 Tbps distributed denial-of-service DDoS attack launched by a Mirai botnet. Characterizing it as a "multi-vector attack consisting of UDP and TCP floods," researcher Omer Yoachimik said the DDoS attack...

Cloudflare Public Bug Bounty: Cloudflare is not properly deleting user's account

Vulnerability description not provided...

Cloudflare Public Bug Bounty: cd=false (DNSSEC) not respected in DNS over HTTPS JSON requests

The value of the cd check disabled flag was not correctly validated in DNS-over-HTTPS JSON API requests to cloudflare-dns.com. In result, despite explicitly setting the flag value to 0 or false according to the Cloudflare 1.1.1.1 documentation the DNSSEC verification was not enforced for an unawa...

Denial Of Service (DoS)

github.com/cloudflare/goflow is vulnerable to denial of service. The vulnerability exists in the DecodeTemplateSet function of netflow.go due to improper handling of sflow packets in the sflow decode package, which allows an attacker to craft malformed packets to consume a huge memory resulting i...

Cloudflare GoFlow vulnerable to a Denial of Service in the sflow packet handling package

Impact The sflow decode package prior to version 3.4.4 does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malformed packets causing the process to consume huge amounts of memory resulting in a denial of service. Specific Go Packages...

GHSA-9RPW-2H95-666C Cloudflare GoFlow vulnerable to a Denial of Service in the sflow packet handling package

Impact The sflow decode package prior to version 3.4.4 does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malformed packets causing the process to consume huge amounts of memory resulting in a denial of service. Specific Go Packages...

Cloudflare Takes a Stab at a Captcha That Doesn’t Suck

The internet infrastructure company has an alternative tool to check whether you’re human—and it doesn’t force you to pick out buses in tiny boxes...

Cloudflare Public Bug Bounty: Take over subdomains of r2.dev using R2 custom domains

███████ ████ ████ ███████████████████████████ ███ ██████████ It is possible to take over any subdomain of r2.dev possible also the base domain and have it serve the contents of an R2 bucket in your account. Requirements Access to R2 public buckets in the dashboard is currently behind a flag. The...

CVE-2022-36083

JOSE is "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers, Electron, and Deno. The PBKDF2-based JWE key management algorithms expect a JOSE Header Parameter named p2c PBES2 Count, which determine...

How 1-Time Passcodes Became a Corporate Liability

Phishers are enjoying remarkable success using text messages to steal remote access credentials and one-time passcodes from employees at some of the worlds largest technology companies and customer support firms. A recent spate of SMS phishing attacks from one cybercriminal group has spawned a...

Okta Hackers Behind Twilio and Cloudflare Attacks Hit Over 130 Organizations

The threat actor behind the attacks on Twilio and Cloudflare earlier this month has been linked to a broader phishing campaign aimed at 136 organizations that resulted in a cumulative compromise of 9,931 accounts. The activity has been condemned 0ktapus by Group-IB because the initial goal of the...

Attackers using fake Cloudflare DDoS protection popups to distribute malware

By Waqas The malware dropped in this attack is the NetSupport RAT which was previously identified in malicious MS Word documents. This is a post from HackRead.com Read the original post: Attackers using fake Cloudflare DDoS protection popups to distribute malware...

Cloudflare Public Bug Bounty: Password Policy Restriction Bypass

Due to insufficient input validation on the backend side, It was possible to bypass the Password Policy Restrictions for Cloudflare accounts by intercepting the request and modifying the content of the password field. This way, a user could set up weak passwords for their account. The password...

dnsReaper - Subdomain Takeover Tool For Attackers, Bug Bounty Hunters And The Blue Team!

DNS Reaper is yet another sub-domain takeover tool, but with an emphasis on accuracy, speed and the number of signatures in our arsenal! We can scan around 50 subdomains per second, testing each one with over 50 takeover signatures. This means most organisations can scan their entire DNS estate i...

Nearly 2,000 Signal users affected by Twilio phishing attack

New findings following the Twilio phishing attack revealed that Signal, one of its high-value clients and a popular encrypted messaging platform, was particularly affected. 1,900 of its users had their phone numbers and SMS registration codes exposed. However, Signal reassured users that the...

nbconvert vulnerable to cross-site scripting (XSS) via multiple exploit paths

Most of the fixes will be in this repo, though, so having it here gives us the private fork to work on patches Below is currently a duplicate of the original report: ---- Received on [email protected] unedited, I'm not sure if we want to make it separate advisories. Pasted raw for now, feel fr...