Hackers Exploit Cloudflare to Bypass Firewall and DDoS Protections

Introduction

Recent research has uncovered a vulnerability that potentially allows attackers to bypass specific security measures provided by Cloudflare, a widely-used content delivery network (CDN) and DDoS protection service. This vulnerability could expose Cloudflare customers to attacks that the platform is designed to defend against. Attackers, utilizing their Cloudflare accounts, can manipulate this vulnerability to nullify configured security measures, rendering them ineffective. Two significant mechanisms affected by this vulnerability are "Authenticated Origin Pulls" and "Allowlist Cloudflare IP addresses."

Vulnerable Mechanisms

1. Authenticated Origin Pulls: This mechanism relies on client SSL certificates to authenticate connections between Cloudflare's reverse proxy servers and the origin server. Attackers can create a custom domain within Cloudflare and direct the DNS A record to the victim's IP address. Then, they can disable all security features for that custom domain within their Cloudflare account. This allows attackers to route their attacks through Cloudflare's infrastructure, effectively evading the victim's security measures.
2. Allowlist Cloudflare IP addresses: This mechanism denies connections that do not originate from within Cloudflare's IP address ranges. Attackers can follow a similar approach by creating a custom domain within Cloudflare and setting the DNS A record to point to the victim's IP address. They can then deactivate all security measures for that custom domain within their Cloudflare account, allowing their attacks to pass through Cloudflare's infrastructure and bypassing the victim's protections.

Severity

• Severity: Medium

Attack Surfaces

• Cloud Service
• Web Application

Recommendations

To mitigate the risks associated with this vulnerability, the following countermeasures are recommended:

1. Review Origin-Server Protections: Ensure that configured protections on your origin servers are consistently enforced.
2. Keep Origin Servers Updated: Keep origin servers up to date with the latest security patches to reduce vulnerabilities.
3. Implement Multi-Factor Authentication (MFA): Enable MFA on all accounts, including your Cloudflare account, to add an extra layer of security.
4. Monitor Website Traffic: Continuously monitor website traffic for any suspicious or anomalous activity.
5. Use Cloudflare Aegis: Utilize Cloudflare Aegis to enable dedicated egress IPs instead of shared IP ranges for enhanced security.
6. Custom Certificates: Implement custom certificates to establish a direct connection between the user's browser and the organization's origin server, reducing the attack surface.

References

• Research Findings Certitude
• Cloudflare DDoS protections ironically bypassed using Cloudflare

Stay vigilant and adhere to these guidelines to ensure the protection of your systems.

Stay Secure.