Cloudflare WARP 安全漏洞

Cloudflare WARP Cloudflare Vpn is a client application for secure connections from Cloudflare, Inc. in the United States. Cloudflare WARP suffers from a security vulnerability that stems from a misconfiguration in its client's manifest file that could allow an attacker to implement execution task...

Cloudflare WARP 输入验证错误漏洞

Cloudflare WARP Cloudflare Vpn is a client-side application for secure connections from Cloudflare, Inc. A security vulnerability in Cloudflare WARP, which stems from a lack of proper validation of the supporturi parameter in its client-side local settings file mdm.xml, allows an attacker to...

Malicious PyPI Packages Using Cloudflare Tunnels to Sneak Through Firewalls

In yet another campaign targeting the Python Package Index PyPI repository, six malicious packages have been found deploying information stealers on developer systems. The now-removed packages, which were discovered by Phylum between December 22 and December 31, 2022, include pyrologin,...

Malicious PyPI Packages Using Cloudflare Tunnels to Sneak Through Firewalls

In yet another campaign targeting the Python Package Index PyPI repository, six malicious packages have been found deploying information stealers on developer systems. The now-removed packages, which were discovered by Phylum between December 22 and December 31, 2022, include pyrologin,...

Cloudflare Public Bug Bounty: Session mismatch leading to potential account takeover (local access required)

Vulnerability description not provided...

Yuga Labs: Origin IP Exposed waf bypass

The origin IP address of the website was exposed, allowing bypassing of the anti-DDoS mechanism in place, such as Cloudflare. This could have enabled access to the service without going through the web application firewall, potentially leading to unfiltered payloads being forwarded to the service...

HTTP Query String Injection

Description The application does not properly sanitize query string parameters in the cloudflare-kv-http,github and http drivers. In the case of the github and http drivers there is no immediate vulnerability, however a slight risk is presented. When a user controls a key within the...

CVE-2014-125026 Out-of-bounds write in github.com/cloudflare/golz4

LZ4 bindings use a deprecated C API that is vulnerable to memory corruption, which could lead to arbitrary code execution if called with untrusted user input...

Cloudflare Public Bug Bounty: Bypassing creation of API tokens without email verification

API tokens could be created without email verification on Cloudflare. If an email-verified account changed their email address without verifying the new email, previously created API tokens remained valid. This vulnerability was addressed by requiring verification before completing the email chan...

Cloudflare Public Bug Bounty: 2FA BYPASS

A vulnerability in Cloudflare's Dashboard allowed for the retrieval of recovery codes without completing the authentication process. The issue was resolved by disallowing requests to the vulnerable API endpoint until users were fully authenticated...

Cloudflare Public Bug Bounty: Origin IP address disclosure through Pingora response header

HTTP responses to cached files served by the Pingora proxy revealed Origin IP address information. An attacker could trigger this misbehaviour by crafting a request with a malformed Range header. The attack was successful under conditions where Cloudflare cache was in REVALIDATED state, the...

Cloudflare Public Bug Bounty: Using special IPv4-mapped IPv6 addresses to bypass local IP ban

Vulnerability description not provided...

Cloudflare Public Bug Bounty: 💥💥Crash report -Cloudflare WARP doesn't verify text length in "Excluded Host" name input data💥💥

Vulnerability description not provided...

Robin Banks Phishing Service for Cybercriminals Returns with Russian Server

A phishing-as-a-service PhaaS platform known as Robin Banks has relocated its attack infrastructure to DDoS-Guard, a Russian provider of bulletproof hosting services. The switch comes after "Cloudflare disassociated Robin Banks phishing infrastructure from its services, causing a multi-day...

Node.js: Take over subdomain undici.nodejs.org.cdn.cloudflare.net

Hello, this is a pretty serious security issue in some contexts, so please act as soon as possible Summary: I just went to undici.nodejs.org, and I've also checked the IP of the main domain it goes to cdn.cloudflare.net which means if it's not added it can be added to any github account your...

Server-side attacks, C&C in public clouds and other MDR cases we observed

Introduction This report describes several interesting incidents observed by the Kaspersky Managed Detection and Response MDR team. The goal of the report is to inform our customers about techniques used by attackers. We hope that learning about the attacks that took place in the wild helps you t...

OctoRPKI crashes when max iterations is reached

Impact Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika Mirdita and Haya Shulman -...

Denial Of Service (DoS)

github.com/cloudflare/cfrpki is vulnerable to denial of service. The vulnerability exists because the validationLoop function in octorpki.go exceeds the max iterations parameter when creating long chains of CAs, allowing an attacker to crash the application...

Twilio Reveals Another Breach from the Same Hackers Behind the August Hack

Communication services provider Twilio this week disclosed that it experienced another "brief security incident" in June 2022 perpetrated by the same threat actor behind the August hack that resulted in unauthorized access of customer information. The security event occurred on June 29, 2022, the...

Cloudflare Public Bug Bounty: Extraction of Pages build scripts, config values, tokens, etc. via symlinks

A vulnerability was discovered in Pages build scripts that allowed malicious actors to extract build source/configuration and environment variables via symlinks due to broader permission set on certain folders within the filesystem structure. The issue was remediated by tightening permissions on...