Skip to content

Commit 4240326

Browse files
ThienltaThienlta
authored
Merge branch 'cloudflare:production' into production
2 parents 1f3051a + 4adcbeb commit 4240326

File tree

107 files changed

+1573
-819
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

107 files changed

+1573
-819
lines changed

‎public/__redirects‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -718,7 +718,6 @@
718718
/fundamentals/get-started/reference/ /fundamentals/reference/ 301
719719
/fundamentals/get-started/reference/http-request-headers/ /fundamentals/reference/http-request-headers/ 301
720720
/fundamentals/get-started/reference/network-ports/ /fundamentals/reference/network-ports/ 301
721-
/fundamentals/get-started/ /fundamentals/setup/ 301
722721
/fundamentals/get-started/setup/allow-cloudflare-ip-addresses/ /fundamentals/concepts/cloudflare-ip-addresses/ 301
723722

724723
#fundamentals revamp cont

‎src/content/changelog/fundamentals/2025-08-15-terraform-v5.8.4-provider.mdx‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
---
2+
title: Terraform v5.8.4 now available
3+
description: Terraform v5.8.4 stablizes a number of resources and known issues
4+
products:
5+
- fundamentals
6+
date: 2025-08-15
7+
---
8+
9+
Earlier this year, we announced the launch of the new [Terraform v5 Provider](/changelog/2025-02-03-terraform-v5-provider/). We are aware of the high number of [issues](https://github.com/cloudflare/terraform-provider-cloudflare) reported by the Cloudflare Community related to the v5 release. We have committed to releasing improvements on a two week cadence to ensure stability and reliability.
10+
11+
One key change we adopted in recent weeks is a pivot to more comprehensive, test-driven development. We are still evaluating individual issues, but are also investing in much deeper testing to drive our stabilization efforts. We will subsequently be investing in comprehensive migration scripts. As a result, you will see several of the highest traffic APIs have been stabilized in the most recent release, and are supported by comprehensive acceptance tests.
12+
13+
Thank you for continuing to raise issues. We triage them weekly and they help make our products stronger.
14+
15+
### Changes
16+
- Resources stabilized:
17+
- `cloudflare_argo_smart_routing`
18+
- `cloudflare_bot_management`
19+
- `cloudflare_list`
20+
- `cloudflare_list_item`
21+
- `cloudflare_load_balancer`
22+
- `cloudflare_load_balancer_monitor`
23+
- `cloudflare_load_balancer_pool`
24+
- `cloudflare_spectrum_application`
25+
- `cloudflare_managed_transforms`
26+
- `cloudflare_url_normalization_settings`
27+
- `cloudflare_snippet`
28+
- `cloudflare_snippet_rules`
29+
- `cloudflare_zero_trust_access_application`
30+
- `cloudflare_zero_trust_access_group`
31+
- `cloudflare_zero_trust_access_identity_provider`
32+
- `cloudflare_zero_trust_access_mtls_certificate`
33+
- `cloudflare_zero_trust_access_mtls_hostname_settings`
34+
- `cloudflare_zero_trust_access_policy`
35+
- `cloudflare_zone`
36+
- Multipart handling restored for `cloudflare_snippet`
37+
- `cloudflare_bot_management` diff issues resolves when running `terraform plan` and `terraform apply`
38+
- Other bug fixes
39+
40+
For a more detailed look at all of the changes, refer to the [changelog](https://github.com/cloudflare/terraform-provider-cloudflare/releases/tag/v5.8.4) in GitHub.
41+
42+
### Issues Closed
43+
- [#5017: 'Uncaught Error: No such module' using cloudflare_snippets](https://github.com/cloudflare/terraform-provider-cloudflare/issues/5017)
44+
- [#5701: cloudflare_workers_script migrations for Durable Objects not recorded in tfstate; cannot be upgraded between versions](https://github.com/cloudflare/terraform-provider-cloudflare/issues/5701)
45+
- [#5640: cloudflare_argo_smart_routing importing doesn't read the actual value](https://github.com/cloudflare/terraform-provider-cloudflare/issues/5640)
46+
47+
If you have an unaddressed issue with the provider, we encourage you to check the [open issues](https://github.com/cloudflare/terraform-provider-cloudflare/issues) and open a new one if one does not already exist for what you are experiencing.
48+
49+
### Upgrading
50+
51+
We suggest holding off on migration to v5 while we work on stablization. This help will you avoid any blocking issues while the Terraform resources are actively being stablized.
52+
53+
If you'd like more information on migrating to v5, please make use of the [migration guide](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/guides/version-5-upgrade). We have provided automated migration scripts using Grit which simplify the transition. These migration scripts do not support implementations which use Terraform modules, so customers making use of modules need to migrate manually. Please make use of `terraform plan` to test your changes before applying, and let us know if you encounter any additional issues by reporting to our [GitHub repository](https://github.com/cloudflare/terraform-provider-cloudflare).
54+
55+
### For more info
56+
57+
- [Terraform provider](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs)
58+
- [Documentation on using Terraform with Cloudflare](/terraform/)

‎src/content/changelog/fundamentals/2025-09-03-rate-limiting-improvement.mdx‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
---
2+
title: Introducing new headers for rate limiting on Cloudflare's API
3+
description: Cloudflare's API handles rate limiting automatically in the SDKs and how to respond appropriately in your code.
4+
products:
5+
- fundamentals
6+
date: 2025-09-03
7+
---
8+
Cloudflare's API now supports rate limiting headers using the pattern developed by the [IETF draft on rate limiting](https://ietf-wg-httpapi.github.io/ratelimit-headers/draft-ietf-httpapi-ratelimit-headers.html). This allows API consumers to know how many more calls are left until the rate limit is reached, as well as how long you will need to wait until more capacity is available.
9+
10+
Our SDKs automatically work with these new headers, backing off when rate limits are approached. There is no action required for users of the latest Cloudflare SDKs to take advantage of this.
11+
12+
As always, if you need any help with rate limits, please contact Support.
13+
14+
### Changes
15+
#### New Headers
16+
17+
**Headers that are always returned:**
18+
- X-RateLimit-Limit: Total Number of requests the caller can make
19+
- X-RateLimit-Remaining: Number of requests before Rate Limit kicks in
20+
21+
**Returned only when a rate limit has been reached (error code: 429):**
22+
- Retry-After: Number of Seconds until more capacity is available, rounded up
23+
- X-RateLimit-Reset: RFC 1123 Formatted Date as to when more capacity is available
24+
25+
#### SDK Back offs
26+
- All SDKs will automatically respond to the headers, instituting a backoff when limits are approached.
27+
28+
### GraphQL and Edge APIs
29+
These new headers and back offs are only available for Cloudflare REST APIs, and will not affect GraphQL.
30+
31+
### For more information
32+
* [Rate limits at Cloudflare](https://developers.cloudflare.com/fundamentals/api/reference/limits/)

‎src/content/changelog/waf/2025-09-08-waf-release.mdx‎

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
---
2+
title: "WAF Release - 2025-09-08"
3+
description: Cloudflare WAF managed rulesets 2025-09-08 release
4+
date: 2025-09-08
5+
---
6+
7+
import { RuleID } from "~/components";
8+
9+
**This week's update**
10+
11+
This week’s focus highlights newly disclosed vulnerabilities in web frameworks, enterprise applications, and widely deployed CMS plugins. The vulnerabilities include SSRF, authentication bypass, arbitrary file upload, and remote code execution (RCE), exposing organizations to high-impact risks such as unauthorized access, system compromise, and potential data exposure. In addition, security rule enhancements have been deployed to cover general command injection and server-side injection attacks, further strengthening protections.
12+
13+
**Key Findings**
14+
15+
* Next.js (CVE-2025-57822): Improper handling of redirects in custom middleware can lead to server-side request forgery (SSRF) when user-supplied headers are forwarded. Attackers could exploit this to access internal services or cloud metadata endpoints. The issue has been resolved in versions 14.2.32 and 15.4.7. Developers using custom middleware should upgrade and verify proper redirect handling in `next()` calls.
16+
17+
* ScriptCase (CVE-2025-47227, CVE-2025-47228): In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), two vulnerabilities allow attackers to reset admin accounts and execute system commands, potentially leading to full compromise of affected deployments.
18+
19+
* Sar2HTML (CVE-2025-34030): In Sar2HTML version 3.2.2 and earlier, insufficient input sanitization of the plot parameter allows remote, unauthenticated attackers to execute arbitrary system commands. Exploitation could compromise the underlying server and its data.
20+
21+
* Zhiyuan OA (CVE-2025-34040): An arbitrary file upload vulnerability exists in the Zhiyuan OA platform. Improper validation in the `wpsAssistServlet` interface allows unauthenticated attackers to upload crafted files via path traversal, which can be executed on the web server, leading to remote code execution.
22+
23+
* WordPress:Plugin:InfiniteWP Client (CVE-2020-8772): A vulnerability in the InfiniteWP Client plugin allows attackers to perform restricted actions and gain administrative control of connected WordPress sites.
24+
25+
**Impact**
26+
27+
These vulnerabilities could allow attackers to gain unauthorized access, execute malicious code, or take full control of affected systems. The Next.js SSRF flaw may expose internal services or cloud metadata endpoints to attackers. Exploitations of ScriptCase and Sar2HTML could result in remote code execution, administrative takeover, and full server compromise. In Zhiyuan OA, the arbitrary file upload vulnerability allows attackers to execute malicious code on the web server, potentially exposing sensitive data and applications. The authentication bypass in WordPress InfiniteWP Client enables attackers to gain administrative access, risking data exposure and unauthorized control of connected sites.
28+
29+
Administrators are strongly advised to apply vendor patches immediately, remove unsupported software, and review authentication and access controls to mitigate these risks.
30+
31+
<table style="width: 100%">
32+
<thead>
33+
<tr>
34+
<th>Ruleset</th>
35+
<th>Rule ID</th>
36+
<th>Legacy Rule ID</th>
37+
<th>Description</th>
38+
<th>Previous Action</th>
39+
<th>New Action</th>
40+
<th>Comments</th>
41+
</tr>
42+
</thead>
43+
<tbody>
44+
<tr>
45+
<td>Cloudflare Managed Ruleset</td>
46+
<td>
47+
<RuleID id="7c5812a31fd94996b3299f7e963d7afc" />
48+
</td>
49+
<td>100007D</td>
50+
<td>Command Injection - Common Attack Commands Args</td>
51+
<td>Log</td>
52+
<td>Block</td>
53+
<td>This rule has been merged into the original rule "Command Injection - Common Attack Commands" (ID: <RuleID id="89557ce9b26e4d4dbf29e90c28345b9b" />) for New WAF customers only.</td>
54+
</tr>
55+
<tr>
56+
<td>Cloudflare Managed Ruleset</td>
57+
<td>
58+
<RuleID id="cd528243d6824f7ab56182988230a75b" />
59+
</td>
60+
<td>100617</td>
61+
<td>Next.js - SSRF - CVE:CVE-2025-57822</td>
62+
<td>Log</td>
63+
<td>Block</td>
64+
<td>This is a New Detection</td>
65+
</tr>
66+
<tr>
67+
<td>Cloudflare Managed Ruleset</td>
68+
<td>
69+
<RuleID id="503b337dac5c409d8f833a6ba22dabf1" />
70+
</td>
71+
<td>100659_BETA</td>
72+
<td>Common Payloads for Server-Side Template Injection - Beta</td>
73+
<td>Log</td>
74+
<td>Block</td>
75+
<td>This rule is merged into the original rule "Common Payloads for Server-Side Template Injection" (ID: <RuleID id="21c7a963e1b749e7b1753238a28a42c4" />)</td>
76+
</tr>
77+
<tr>
78+
<td>Cloudflare Managed Ruleset</td>
79+
<td>
80+
<RuleID id="6d24266148f24f5e9fa487f8b416b7ca" />
81+
</td>
82+
<td>100824B</td>
83+
<td>CrushFTP - Remote Code Execution - CVE:CVE-2025-54309 - 3</td>
84+
<td>Log</td>
85+
<td>Disabled</td>
86+
<td>This is a New Detection</td>
87+
</tr>
88+
<tr>
89+
<td>Cloudflare Managed Ruleset</td>
90+
<td>
91+
<RuleID id="154b217c43d04f11a13aeff05db1fa6b" />
92+
</td>
93+
<td>100848</td>
94+
<td>ScriptCase - Auth Bypass - CVE:CVE-2025-47227</td>
95+
<td>Log</td>
96+
<td>Disabled</td>
97+
<td>This is a New Detection</td>
98+
</tr>
99+
<tr>
100+
<td>Cloudflare Managed Ruleset</td>
101+
<td>
102+
<RuleID id="cad6f1c8c6d44ef59929e6532c62d330" />
103+
</td>
104+
<td>100849</td>
105+
<td>ScriptCase - Command Injection - CVE:CVE-2025-47228</td>
106+
<td>Log</td>
107+
<td>Disabled</td>
108+
<td>This is a New Detection</td>
109+
</tr>
110+
<tr>
111+
<td>Cloudflare Managed Ruleset</td>
112+
<td>
113+
<RuleID id="e7464139fd3e44938b56716bef971afd" />
114+
</td>
115+
<td>100872</td>
116+
<td>WordPress:Plugin:InfiniteWP Client - Missing Authorization - CVE:CVE-2020-8772</td>
117+
<td>Log</td>
118+
<td>Block</td>
119+
<td>This is a New Detection</td>
120+
</tr>
121+
<tr>
122+
<td>Cloudflare Managed Ruleset</td>
123+
<td>
124+
<RuleID id="0181ebb2cc234f2d863412e1bab19b0b" />
125+
</td>
126+
<td>100873</td>
127+
<td>Sar2HTML - Command Injection - CVE:CVE-2025-34030</td>
128+
<td>Log</td>
129+
<td>Block</td>
130+
<td>This is a New Detection</td>
131+
</tr>
132+
<tr>
133+
<td>Cloudflare Managed Ruleset</td>
134+
<td>
135+
<RuleID id="34d5c7c7b08b40eaad5b2bb3f24c0fbe" />
136+
</td>
137+
<td>100875</td>
138+
<td>Zhiyuan OA - Remote Code Execution - CVE:CVE-2025-34040</td>
139+
<td>Log</td>
140+
<td>Block</td>
141+
<td>This is a New Detection</td>
142+
</tr>
143+
</tbody>
144+
</table>

‎src/content/changelog/waf/scheduled-waf-release.mdx‎

Lines changed: 16 additions & 82 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
2-
title: WAF Release - Scheduled changes for 2025-09-08
3-
description: WAF managed ruleset changes scheduled for 2025-09-08
4-
date: 2025-09-01
2+
title: WAF Release - Scheduled changes for 2025-09-15
3+
description: WAF managed ruleset changes scheduled for 2025-09-15
4+
date: 2025-09-08
55
scheduled: true
66
---
77

@@ -21,103 +21,37 @@ import { RuleID } from "~/components";
2121
</thead>
2222
<tbody>
2323
<tr>
24-
<td>2025-09-01</td>
2524
<td>2025-09-08</td>
25+
<td>2025-09-15</td>
2626
<td>Log</td>
27-
<td>100007D</td>
27+
<td>100646</td>
2828
<td>
29-
<RuleID id="7c5812a31fd94996b3299f7e963d7afc" />
29+
<RuleID id="199cce9ab21e40bcb535f01b2ee2085f" />
3030
</td>
31-
<td>Command Injection - Common Attack Commands Args</td>
32-
<td>Beta detection. This will be merged into the original rule "Command Injection - Common Attack Commands" (ID: <RuleID id="89557ce9b26e4d4dbf29e90c28345b9b" />)</td>
33-
</tr>
34-
<tr>
35-
<td>2025-09-01</td>
36-
<td>2025-09-08</td>
37-
<td>Log</td>
38-
<td>100617</td>
39-
<td>
40-
<RuleID id="cd528243d6824f7ab56182988230a75b" />
41-
</td>
42-
<td>Next.js - SSRF - CVE:CVE-2025-57822</td>
43-
<td>This is a New Detection</td>
44-
</tr>
45-
<tr>
46-
<td>2025-09-01</td>
47-
<td>2025-09-08</td>
48-
<td>Log</td>
49-
<td>100659_BETA</td>
50-
<td>
51-
<RuleID id="503b337dac5c409d8f833a6ba22dabf1" />
52-
</td>
53-
<td>Common Payloads for Server-Side Template Injection - Beta</td>
54-
<td>Beta detection. This will be merged into the original rule "Common Payloads for Server-Side Template Injection" (ID: <RuleID id="21c7a963e1b749e7b1753238a28a42c4" />)</td>
55-
</tr>
56-
<tr>
57-
<td>2025-09-01</td>
58-
<td>2025-09-08</td>
59-
<td>Log</td>
60-
<td>100824B</td>
61-
<td>
62-
<RuleID id="6d24266148f24f5e9fa487f8b416b7ca" />
63-
</td>
64-
<td>CrushFTP - Remote Code Execution - CVE:CVE-2025-54309 - 3</td>
65-
<td>This is a New Detection</td>
66-
</tr>
67-
<tr>
68-
<td>2025-09-01</td>
69-
<td>2025-09-08</td>
70-
<td>Log</td>
71-
<td>100848</td>
72-
<td>
73-
<RuleID id="154b217c43d04f11a13aeff05db1fa6b" />
74-
</td>
75-
<td>ScriptCase - Auth Bypass - CVE:CVE-2025-47227</td>
31+
<td>Argo CD - Information Disclosure - CVE:CVE-2025-55190</td>
7632
<td>This is a New Detection</td>
7733
</tr>
7834
<tr>
79-
<td>2025-09-01</td>
8035
<td>2025-09-08</td>
36+
<td>2025-09-15</td>
8137
<td>Log</td>
82-
<td>100849</td>
38+
<td>100874</td>
8339
<td>
84-
<RuleID id="cad6f1c8c6d44ef59929e6532c62d330" />
40+
<RuleID id="e513bb21b6a44f9cbfcd2462f5e20788" />
8541
</td>
86-
<td>ScriptCase - Command Injection - CVE:CVE-2025-47228</td>
42+
<td>DataEase - JNDI injection - CVE:CVE-2025-57773</td>
8743
<td>This is a New Detection</td>
8844
</tr>
8945
<tr>
90-
<td>2025-09-01</td>
9146
<td>2025-09-08</td>
47+
<td>2025-09-15</td>
9248
<td>Log</td>
93-
<td>100872</td>
49+
<td>100880</td>
9450
<td>
95-
<RuleID id="e7464139fd3e44938b56716bef971afd" />
51+
<RuleID id="be097f5a71a04f27aa87b60d005a12fd" />
9652
</td>
97-
<td>WordPress:Plugin:InfiniteWP Client - Missing Authorization - CVE:CVE-2020-8772</td>
53+
<td>Sitecore - Information Disclosure - CVE:CVE-2025-53694</td>
9854
<td>This is a New Detection</td>
99-
</tr>
100-
<tr>
101-
<td>2025-09-01</td>
102-
<td>2025-09-08</td>
103-
<td>Log</td>
104-
<td>100873</td>
105-
<td>
106-
<RuleID id="0181ebb2cc234f2d863412e1bab19b0b" />
107-
</td>
108-
<td>Sar2HTML - Command Injection - CVE:CVE-2025-34030</td>
109-
<td>This is a New Detection</td>
110-
</tr>
111-
<tr>
112-
<td>2025-09-01</td>
113-
<td>2025-09-08</td>
114-
<td>Log</td>
115-
<td>100875</td>
116-
<td>
117-
<RuleID id="34d5c7c7b08b40eaad5b2bb3f24c0fbe" />
118-
</td>
119-
<td>Zhiyuan OA - Remote Code Execution - CVE:CVE-2025-34040</td>
120-
<td>This is a New Detection</td>
121-
</tr>
55+
</tr>
12256
</tbody>
12357
</table>

0 commit comments

Comments
 (0)