CVE-2017-7235

An issue was discovered in cloudflare-scrape 1.6.6 through 1.7.1. A malicious website owner could craft a page that executes arbitrary Python code against any cfscrape user who scrapes that website. This is fixed in 1.8.0...

CVE-2017-7235

An issue was discovered in cloudflare-scrape 1.6.6 through 1.7.1. A malicious website owner could craft a page that executes arbitrary Python code against any cfscrape user who scrapes that website. This is fixed in 1.8.0...

CVE-2017-7235

CVE-2017-7235 affects cloudflare-scrape (Python module). The issue enables a malicious page to cause arbitrary Python code execution against a user of cloudflare-scrape versions 1.6.6 through 1.7.1. Root cause details describe code execution when scraping a crafted page; the advisory notes the fi...

CVE-2017-7235

An issue was discovered in cloudflare-scrape 1.6.6 through 1.7.1. A malicious website owner could craft a page that executes arbitrary Python code against any cfscrape user who scrapes that website. This is fixed in 1.8.0...

CVE-2017-7235

An issue was discovered in cloudflare-scrape 1.6.6 through 1.7.1. A malicious website owner could craft a page that executes arbitrary Python code against any cfscrape user who scrapes that website. This is fixed in 1.8.0...

CVE-2017-7235: Improper Input Validation

An issue was discovered in cloudflare-scrape 1.6.6 through 1.7.1. A malicious website owner could craft a page that executes arbitrary Python code against any cfscrape user who scrapes that website. This is fixed in 1.8.0...

PT-2017-17597

Name of the Vulnerable Software and Affected Versions cloudflare-scrape versions 1.6.6 through 1.7.1 Description A malicious website owner could craft a page that executes arbitrary Python code against any cfscrape user who scrapes that website. Recommendations For versions 1.6.6 through 1.7.1,...

Synchronize Your DNS to Multiple Providers: DNSControl

Synchronize Your DNS to Multiple Providers DNSControl is a system for maintaining DNS zones. It has two parts: a domain specific language DSL for describing DNS zones plus software that processes the DSL and pushes the resulting zones to DNS providers such as Route53, CloudFlare, and Gandi. It ca...

Cloudflare: Cloudflare based XSS for IE11

XSS can be performed via malformed URI request in IE11and potentially in Edge. Cloudflare has a vulnerable default error page for HTTP 522. For example it takes some time: https://hacker.one/%ff Lets use IE11 to proof the concept. https://hacker.one/%ff/?"escaped Result:...

Blockchain: HTTP Header Injection/HTTP_Response_Splitting

Submitter observed that CloudFlare-protected sites will serve content from other CloudFlare-protected sites when the "Host" HTTP request header is modified in transit. A PoC for an attacker to modify a victim user's "Host" HTTP request header could not be presented by the submitter; consequently...

CloudFlare Information Disclosure Vulnerability

CloudFlare is an American multinational technology company that provides security services to help websites stop hacking, spamming, etc. from the web and improve the speed of web browsing. CloudFlare has an information disclosure vulnerability. An attacker can exploit this vulnerability to gain...

HatCloud - Tool for identify real IP of CloudFlare (Bypass CloudFlare)

HatCloud build in Ruby. It makes bypass in CloudFlare for discover real IP. This can be useful if you need test your server and website. Testing your protection against Ddos Denial of Service or Dos. CloudFlare is services and distributed domain name server services, sitting between the visitor a...

Cloudflare Server Detection via HTTP/HTTPS

Binary data 7256.pasl...

HTTP/HTTPS Client Connection to Cloudflare Server

Binary data 9975.prm...

Cloudbleed Triggered 1.2M Times, Damage Kept to Minimum

Having had more than a week to digest Cloudbleed’s causes and impact, Cloudflare CEO Matthew Prince assessed the damage yesterday in a lengthy post-mortem as relatively low. Prince said there is no evidence the vulnerability, which leaked customer data from memory, was exploited by attackers. The...

Cloudflare Client Detection via HTTP/HTTPS

Binary data 7252.pasl...

Cloudflare Client Detection via DNS

Binary data 7255.pasl...

Authoritative Cloudflare DNS Server Detection

Binary data 9976.prm...

Buffer Overflow Vulnerability in CloudFlare Server

CloudFlare is a U.S. content delivery network CDN and network security provider, mainly providing technical support to customer websites related to website security management, performance optimization and other related technical support. CloudFlare serves more than 5.5 million websites worldwide...

Threatpost News Wrap, February 24, 2017

Mike Mimoso and Chris Brook recap RSA and discuss the news of the week including the impact of Cloudflare’s “Cloudbleed” bug, Google breaking SHA-1, and more. Download: ThreatpostNewsWrapFebruary242017.mp3 Music by Chris Gonsalves...