The effectiveness of Cloudflare’s firewall and distributed denial-of-service (DDoS) attack prevention mechanisms has been questioned due to vulnerabilities that allow attackers to exploit gaps in cross-tenant security controls.
This issue arises from the shared infrastructure utilized by all Cloudflare tenants, legitimate and malicious alike, which facilitates the abuse of trust relationships inherent to the service.
Potential Vulnerabilities that Could Be Exploited
Authenticated Origin Pulls
One vulnerability arises from using a shared Cloudflare certificate for authenticating HTTP(S) requests between Cloudflare’s reverse proxies and customers’ origin servers, a feature known as Authenticated Origin Pulls.
While this feature aims to ensure that requests to the origin server originate from Cloudflare and not from malicious actors, it inadvertently permits attackers with Cloudflare accounts to send their malicious payloads via the platform.
Attackers can set up custom domains with Cloudflare, point DNS A records to victims’ IP addresses, and disable protection features for those domains, bypassing the intended security measures.
Whitelist Cloudflare IP
The second issue involves the abuse of whitelist Cloudflare IP addresses, which restricts traffic to the origin server to only Cloudflare IP addresses. Attackers can misuse this to transmit malicious inputs and target other platform users.
Cloudflare’s Action
Cloudflare acknowledged these findings and issued a new warning in its documentation, emphasizing the need for customers to set up Authenticated Origin Pulls with their certificates for enhanced security.
Next step: Thinking Hats Solve Problems
The information presented raises concerns about the effectiveness of Cloudflare’s security mechanisms. Shared infrastructure allowing attackers to abuse trust relationships is a factual vulnerability that must be addressed.
Additionally, the misuse of Cloudflare certificates and the abuse of IP allowlisting are valid security issues.
To see such vulnerabilities in a widely trusted security service like Cloudflare is worrying. This could lead to significant security breaches.
There are significant risks associated with these vulnerabilities. If not addressed promptly, they could result in data breaches, service disruptions, and damage to organizations relying on Cloudflare for protection.
The potential for subdomain hijacking and the use of dynamically seeded domain generation algorithms by adversaries further underscores the severity of these risks.
On a positive note, the responsible disclosure of these vulnerabilities and Cloudflare’s acknowledgment and documentation updates is a progressive step towards better security practices.
To mitigate these risks, Cloudflare should consider implementing more robust authentication measures for Authenticated Origin Pulls, such as multi-factor authentication.
Additionally, they could enhance IP allowlisting controls to prevent misuse. Regular security audits and proactive monitoring for subdomain hijacking can also help.
Anas Hasan
October 4, 2023
2 years ago
