Cloudflare WAF now blocks new SSRF and SSTI attack patterns!

Hi, I'm Shii-chan! Today I've got a WAF (Web Application Firewall) rule update from the Cloudflare Changelog. It might look small, but it actually closes off attacks that could let someone hijack your server — a meaningful update!

Cloudflare Changelog developers.cloudflare.com

What was announced?

According to the Cloudflare Changelog, this WAF release adds four new detection rules to the Cloudflare Managed Ruleset. They target two kinds of attacks.

• SSRF (Server-Side Request Forgery) — using non-standard IP notations or jar loopback payloads
• SSTI (Server-Side Template Injection) — targeting the Jinja template engine

Here are the specific rules that were added.

• 5f21b651: SSRF - Cloud,Link-Local non-standard IP notation
• 0f0313d6: SSRF - Block jar HTTP loopback payload
• 75cd912a: SSRF - Local non-standard IP notation
• a1ba83f6: SSTI - Jinja Dangerous Globals Chain

All four have "N/A" for Legacy Rule ID, meaning they're brand-new detections.

The story so far

These four rules didn't appear out of nowhere: they previously ran with Previous Action set to "Log," meaning suspicious traffic was recorded but not actually blocked.

What changes

With this release, the New Action for all four rules switches to "Block." Traffic matching these SSRF and SSTI patterns, which was only being logged before, now gets blocked outright!

• Sites with the Cloudflare Managed Ruleset enabled get this stronger protection automatically, no extra setup needed
• SSRF lets attackers push a server into reaching internal resources or cloud metadata services. This update blocks tricks that use disguised IP notations to slip past IP filters, as well as ones abusing the jar scheme's loopback behavior
• SSTI injects malicious code into template engines like Jinja to run arbitrary logic server-side. The newly blocked pattern targets chains that reach Jinja's dangerous Globals

Wrap-up

• The Cloudflare Managed Ruleset gained three new SSRF detections and one new SSTI detection
• SSRF rules target non-standard IP notations and jar loopback payloads; the SSTI rule targets Jinja's dangerous Globals chain
• All four rules moved from Log to Block, turning detection into real-time blocking
• It's a welcome automatic upgrade for anyone running sites behind Cloudflare's WAF, and worth a look for engineers whose apps need SSRF/SSTI protection!