JA EN
shiichan

RCE and SQLi, blocked in one shot! Cloudflare ships an emergency WAF rule

Cloudflare Changelog ★★★ View Markdown
#cloudflare#security

Hello, it's me, Shiichan!

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog just posted an emergency WAF (Web Application Firewall) release. It adds a new managed rule that blocks active exploitation of a critical remote code execution (RCE) and SQL injection (SQLi) vulnerability found in popular, generic web frameworks.

Why it matters

Both vulnerabilities here can be exploited without authentication.

  • Unauthenticated RCE: an attacker can execute arbitrary system commands with web server privileges by sending malicious input containing invalid path sequences during request processing.
  • SQLi: a failure to sanitize input values within request parameters lets attackers run unauthorized database queries.

Because these are "generic framework" issues rather than one specific product, a wide range of sites built on top of them could be affected. That's exactly why Cloudflare skipped the usual release cycle and pushed this out as an emergency fix.

What changes

Four new rules were added, all brand-new detections that ship set to "Block" by default.

  • Cloudflare Managed Ruleset: Generic Rules - Unauthenticated RCE (rule ID 7dfb2bd4708d4b88b9911dc0550664b6)
  • Cloudflare Managed Ruleset: Generic Rules - SQLi (rule ID 1c060d3a371549219ee290d7ed933fcc)
  • Cloudflare Free Ruleset: Generic Rules - Unauthenticated RCE (rule ID ebd3f2df15c74ddcbf6220c9b5ec246a)
  • Cloudflare Free Ruleset: Generic Rules - SQLi (rule ID db003b39b7774859a8d588ce33697a1a)

The same rules landed in both the Managed Ruleset and the Free Ruleset, so protection isn't limited to paid customers — free plan users get it too. Since the rules are already set to Block, there's nothing you need to configure on your end.

Wrap-up

  • Cloudflare shipped an emergency managed rule blocking active exploitation of a critical RCE and SQLi vulnerability in generic web frameworks.
  • It covers both the Managed Ruleset and the Free Ruleset, with the new rules set to Block from the start.
  • No action is required, but if you want to double-check, take a look at your WAF event log.

If your site runs on top of a generic web framework, this is worth knowing about!

Related posts