JA EN
shiichan

We Let Frontier AI Attack Cloudflare's Own WAF: Here's What It Found

Cloudflare Blog ★★★ View Markdown
#cloudflare#security#ai

Hi, it's Shii-chan!

Cloudflare Blog blog.cloudflare.com

Today Cloudflare shared how it had AI attack its own WAF. The post covers the weaknesses found and how they were fixed, and it was a great read!

What was announced?

The Cloudflare Blog published results from adaptive WAF testing with frontier AI models. Cloudflare built a tester that adapts each request based on what the WAF blocked or passed, and ran it on an authorized staging environment.

Why it matters

Fixed tests tend to miss small variations of an attack. Using AI to mutate attacks automatically can explore variations people wouldn't think of, which is valuable for defenders too.

What changes

  • Detection gaps that fixed tests missed can feed into rule improvements
  • Fixes land in the Managed Ruleset, so customers benefit as well

Dive Deep

Here is the method.

  • Two-stage LLM process: a proposal call suggests mutations, and a review call analyzes responses
  • The models get no access to WAF internals, rules, or scores
  • Mutations try a different encoding, a different part of the request, or the same destination written another way
  • A custom Python implementation with request replay and scenario orchestration, not a wrapper around existing tools

There were six attack categories.

  • Cross-site scripting (XSS)
  • SQL injection (SQLi)
  • Command injection (CMDi)
  • Server-side request forgery (SSRF)
  • Path traversal / local file inclusion (LFI)
  • Log4j exploitation

Across 45 scenarios the tester made 1,107 mutation attempts, and the WAF blocked 558 requests. After human triage, 49 findings worth investigating remained, mostly CMDi and SSRF. XSS, LFI, SQLi, and Log4j showed near full coverage.

The most significant gap was SSRF using obfuscated IP address representations, such as integer, octal, and trailing-dot formats. For example, the trailing-dot form 169.254.169.254. got through where the standard form was blocked. Unblocked requests went through a five-question triage before becoming findings.

Cloudflare made three improvements to the Managed Ruleset.

  • A new "SSRF - Obfuscated Host" detection (released July 21)
  • A new "SSRF - Restricted Protocol" detection (released July 21)
  • An enhanced existing "SSRF - Cloud" rule (released August 4)

Wrap-up

  • An AI tester that mutates requests based on WAF responses covered six categories
  • 45 scenarios and 1,107 attempts produced 49 findings to investigate
  • The main gap was SSRF with obfuscated IP addresses, and the Managed Ruleset was updated
  • Human triage was key to result quality

This is a practical read for anyone interested in WAFs and automated security testing!

Related posts