Cloudflare Public Bug Bounty: HTTP Request Smuggling in Transform Rules using hexadecimal escape sequences in the concat() function

The Edge Rules engine used by Cloudflare Transform Rules features string modifying functions like lower and concat, which accepted hexadecimal-encoded characters such as ”\x0a\x0d“. This allowed for manipulation of request headers e.g. injecting an additional header and, as a consequence, made HT...

Cloudflare Public Bug Bounty: Blind SSRF on platform.dash.cloudflare.com Due to Sentry misconfiguration

Cloudflare uses Sentry for application monitoring and error tracking. Due to the tool's misconfiguration source code scraping feature enabled, it was possible to sent blind requests to any endpoints using the Cloudflare infrastructure. The issue has been fixed by the Engineering team and the sour...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

Apache-Log4j-POC CVE-2021-44228 Proof of Concept of apache log...

On the Log4j Vulnerability

Its serious: The range of impacts is so broad because of the nature of the vulnerability itself. Developers use logging frameworks to keep track of what happens in a given application. To exploit Log4Shell, an attacker only needs to get the system to log a strategically crafted string of code. Fr...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

l4j-info Compiling valuable links as I find them documenting C...

Cloudflare Public Bug Bounty: Hijack all emails sent to any domain that uses Cloudflare Email Forwarding

The Email Routing feature enables Cloudflare users to create any number of custom email addresses and route all incoming messages to the user's preferred inboxes. Due to a bug in zone ownership verification, it was possible to configure Email Routing to redirect e-mail messages for an unverified...

Privilege Escalation

github.com/cloudflare/cfrpki is vulnerable to privilege escalation. when copying files using rsync, octorpki uses the "-a" flag 0, which forces rsync to copy binaries with the suid bit set as root, which allows an attacker to inject and execute a malicious TAL file...

Improper Preservation of Permissions in github.com/cloudflare/cfrpki/cmd/octorpki

Impact When copying files with rsync, octorpki uses the "-a" flag 0, which forces rsync to copy binaries with the suid bit set as root. Since the provided service definition defaults to root https://github.com/cloudflare/cfrpki/blob/master/package/octorpki.service this could allow for a vector,...

Denial Of Service (DoS)

github.com/cloudflare/cfrpki is vulnerable to denial of service DoS attacks. A malicious user is able to send an encoded null \0 character as an invalid ROA from a repository, causing an application crash...

Denial Of Service (DoS)

github.com/cloudflare/cfrpki is vulnerable to denial of service. The vulnerability exists in the main of octorpki.go because the OctoRPKI doesn't limit the connections it opens before the response is returned which results in an application crash...

Denial Of Service (DoS)

validator/lib/librpki of github.com/cloudflare/cfrpki is vulnerable to denial of service. The vulnerabiltiy exists becausse an ROA returned with too many bits for the IP address can cause OctoRPKI to crash...

Denial Of Service (DoS)

github.com/cloudflare/cfrpki is vulnerable to denial of service. The vulnerability exists due to the lack of check of the size of the incoming compressed file allowing an attacker to crash the system via a GZIP bomb attack...

Cloudflare OctoRPKI 资源管理错误漏洞

Cloudflare OctoRPKI is an RPKI toolkit for the Cloudflare platform from cloudflare USA. Cloudflare OctoRPKI has a security vulnerability that originates from an improperly designed or implemented code development process for a network system or product...

Cloudflare OctoRPKI 安全漏洞

Cloudflare OctoRPKI is an RPKI toolkit for the Cloudflare platform from cloudflare USA. Cloudflare OctoRPKI has a security vulnerability that originates from an improperly designed or implemented code development process for a network system or product...

Cloudflare OctoRPKI 输入验证错误漏洞

Cloudflare OctoRPKI is an RPKI toolkit for the Cloudflare platform from cloudflare USA. Cloudflare OctoRPKI suffers from an input validation error vulnerability that stems from OctoRPKI crashing when it encounters a repository that returns an invalid ROA, which is just an encoded NUL character...

Cloudflare OctoRPKI 资源管理错误漏洞

Cloudflare OctoRPKI is an RPKI toolkit for the Cloudflare platform from cloudflare USA. Cloudflare OctoRPKI has a security vulnerability that allows an attacker to send a slow DOS attack, which keeps OctoRPKI in a waiting state...

Cloudflare OctoRPKI 资源管理错误漏洞

Cloudflare OctoRPKI is an RPKI toolkit for the Cloudflare platform from cloudflare USA. A security vulnerability exists in Cloudflare OctoRPKI that allows the CA to traverse the directory structure by creating child nodes in a specific way...

Cloudflare OctoRPKI 路径遍历漏洞

Cloudflare OctoRPKI is an RPKI toolkit for the Cloudflare platform from cloudflare USA. Cloudflare OctoRPKI suffers from a path traversal vulnerability that could allow an attacker to remotely execute code on the host...

Infinite certificate chain depth results in OctoRPKI running forever

OctoRPKI github.com/cloudflare/cfrpki/cmd/octorpki does not limit the depth of a certificate chain, allowing for a CA to create children in an ad-hoc fashion, thereby making tree traversal never end. For more information If you have any questions or comments about this advisory email us at...

GHSA-8CVR-4RRF-F244 Infinite open connection causes OctoRPKI to hang forever

OctoRPKI github.com/cloudflare/cfrpki/cmd/octorpki does not limit the length of a connection, allowing for a slowloris DOS attack to take place which makes OctoRPKI wait forever. Specifically, the repository that OctoRPKI sends HTTP requests to will keep the connection open for a day before a...