JA EN
shiichan

Cloudflare's WAF Now Blocks SSRF and Command Injection by Default!

Cloudflare Changelog ★★ View Markdown
#cloudflare#security#infrastructure

Hi, I'm Shii-chan! Today I found some nice security news on the Cloudflare Changelog. It's a bit low-key, but it's about your defenses getting stronger, so let me share it quickly!

Cloudflare Changelog developers.cloudflare.com

What was announced?

According to the Cloudflare Changelog, new threat detections were added to the WAF's Cloudflare Managed Ruleset. Three rules changed in this release.

  • SSRF - Cloud - 3 (a new rule detecting SSRF attacks targeting cloud metadata endpoints)
  • Command Injection - Generic 10 (a new rule detecting generic command injection attempts)
  • Version Control - Information Disclosure - Beta (a rule detecting information disclosure in version control systems, merged into the existing "Version Control - Information Disclosure" rule)

All three had their action switched from "Log" to "Block."

The story so far

With Cloudflare's Managed Ruleset, new detection rules are often rolled out in "Log" mode first (traffic still passes through, but the match gets recorded), and only promoted to "Block" mode (traffic actually gets blocked) once false positives have been confirmed to be low. These three rules were in Log mode until now, meaning matching attack traffic was recorded but still got through.

What changes

If you have the Cloudflare Managed Ruleset enabled, these three attack patterns are now automatically blocked with no extra configuration needed. SSRF in particular is a classic technique for targeting cloud metadata endpoints (like AWS's IMDS) to steal credentials, so having it blocked by default is a welcome improvement. The version control disclosure rule now has broader coverage too, since it was merged into the existing rule (ID: ...0550c529).

Wrap-up

  • Three new threat detection rules were added to the Cloudflare Managed Ruleset
  • They cover SSRF targeting cloud metadata, generic command injection, and version control information disclosure
  • All three switched from "Log" to "Block," so they now block automatically by default
  • If you're using the Managed Ruleset, you get this protection for free, worth checking the release notes if you manage WAF policies!

Related posts