Skip to content

Commit 2d52ccb

Browse files
ay-cfay-cf
committed
2025-09-22 waf release note
1 parent d86748a commit 2d52ccb

File tree

2 files changed

+152
-74
lines changed

2 files changed

+152
-74
lines changed

‎src/content/changelog/waf/2025-09-22-waf-release.mdx‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
---
2+
title: "WAF Release - 2025-09-22"
3+
description: Cloudflare WAF managed rulesets 2025-09-22 release
4+
date: 2025-09-22
5+
---
6+
7+
import { RuleID } from "~/components";
8+
9+
This week emphasizes two critical vendor-specific vulnerabilities: a full elevation-of-privilege in Microsoft Azure Networking (CVE-2025-54914) and a server-side template injection (SSTI) leading to remote code execution (RCE) in Skyvern (CVE-2025-49619). These are complemented by enhancements in generic detections (SQLi, SSRF) to improve baseline coverage.
10+
11+
**Key Findings**
12+
13+
14+
* Azure (CVE-2025-54914): Vulnerability in Azure Networking allowing elevation of privileges.
15+
16+
* Skyvern (CVE-2025-49619): Skyvern ≤ 0.1.85 has a server-side template injection (SSTI) vulnerability in its Prompt field (workflow blocks) via Jinja2. Authenticated users with low privileges can get remote code execution (blind).
17+
18+
* Generic SQLi / SSRF improvements: Expanded rule coverage to detect obfuscated SQL injection patterns and SSRF across host, local, and cloud contexts.
19+
20+
**Impact**
21+
22+
These vulnerabilities allow attackers to escalate privileges or execute code under conditions where previously they could not:
23+
24+
* Azure CVE-2025-54914 enables an attacker from the network with no credentials to gain high-level access within Azure Networking; could lead to full compromise of networking components.
25+
26+
* Skyvern CVE-2025-49619 allows authenticated users with minimal privilege to exploit SSTI for remote code execution, undermining isolation of workflow components.
27+
28+
* The improvements for SQLi and SSRF reduce risk from common injection and request-based attacks.
29+
30+
31+
<table style="width: 100%">
32+
<thead>
33+
<tr>
34+
<th>Ruleset</th>
35+
<th>Rule ID</th>
36+
<th>Legacy Rule ID</th>
37+
<th>Description</th>
38+
<th>Previous Action</th>
39+
<th>New Action</th>
40+
<th>Comments</th>
41+
</tr>
42+
</thead>
43+
<tbody>
44+
<tr>
45+
<td>Cloudflare Managed Ruleset</td>
46+
<td>
47+
<RuleID id="c36a425ae0c94789a9bc34f06a135cbf" />
48+
</td>
49+
<td>100146</td>
50+
<td>SSRF - Host - 2</td>
51+
<td>Log</td>
52+
<td>Disabled</td>
53+
<td>This is a New Detection</td>
54+
</tr>
55+
<tr>
56+
<td>Cloudflare Managed Ruleset</td>
57+
<td>
58+
<RuleID id="dfa84b0aed5a4b45b953a36a57035abf" />
59+
</td>
60+
<td>100146B</td>
61+
<td>SSRF - Local - 2</td>
62+
<td>Log</td>
63+
<td>Disabled</td>
64+
<td>This is a New Detection</td>
65+
</tr>
66+
<tr>
67+
<td>Cloudflare Managed Ruleset</td>
68+
<td>
69+
<RuleID id="276073e60c7a4b4d91faba1fbbe18d50" />
70+
</td>
71+
<td>100146C</td>
72+
<td>SSRF - Cloud - 2</td>
73+
<td>Log</td>
74+
<td>Disabled</td>
75+
<td>This is a New Detection</td>
76+
</tr>
77+
<tr>
78+
<td>Cloudflare Managed Ruleset</td>
79+
<td>
80+
<RuleID id="78c856218f2d40f4b5988c8c956c1961" />
81+
</td>
82+
<td>100714</td>
83+
<td>Azure - Auth Bypass - CVE:CVE-2025-54914</td>
84+
<td>Log</td>
85+
<td>block</td>
86+
<td>This is a New Detection</td>
87+
</tr>
88+
<tr>
89+
<td>Cloudflare Managed Ruleset</td>
90+
<td>
91+
<RuleID id="9f1c8d4cbf3848dbb940771bc5ced231" />
92+
</td>
93+
<td>100758</td>
94+
<td>Skyvern - Remote Code Execution - CVE:CVE-2025-49619</td>
95+
<td>Log</td>
96+
<td>block</td>
97+
<td>This is a New Detection</td>
98+
</tr>
99+
<tr>
100+
<td>Cloudflare Managed Ruleset</td>
101+
<td>
102+
<RuleID id="6be7e7829f3b43c688e1ac4284a619a1" />
103+
</td>
104+
<td>100773</td>
105+
<td>Next.js - SSRF</td>
106+
<td>Log</td>
107+
<td>Block</td>
108+
<td>This is a New Detection</td>
109+
</tr>
110+
<tr>
111+
<td>Cloudflare Managed Ruleset</td>
112+
<td>
113+
<RuleID id="0cc3f50216bf4b448210bcc3983ff2dd" />
114+
</td>
115+
<td>100774</td>
116+
<td>Adobe Commerce - Remote Code Execution - CVE:CVE-2025-54236</td>
117+
<td>Log</td>
118+
<td>Block</td>
119+
<td>This is a New Detection</td>
120+
</tr>
121+
<tr>
122+
<td>Cloudflare Managed Ruleset</td>
123+
<td>
124+
<RuleID id="53bfaeb311a049e3877fa15c0380a1a6" />
125+
</td>
126+
<td>100800_BETA</td>
127+
<td>SQLi - Obfuscated Boolean - Beta</td>
128+
<td>Log</td>
129+
<td>Block</td>
130+
<td>This rule has been merged into the original rule (ID: <RuleID id="7663ea44178441a0b3205c145563445f" /></td>
131+
</tr>
132+
</tbody>
133+
</table>

‎src/content/changelog/waf/scheduled-waf-release.mdx‎

Lines changed: 19 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
2-
title: WAF Release - Scheduled changes for 2025-09-22
3-
description: WAF managed ruleset changes scheduled for 2025-09-22
4-
date: 2025-09-15
2+
title: WAF Release - Scheduled changes for 2025-09-29
3+
description: WAF managed ruleset changes scheduled for 2025-09-29
4+
date: 2025-09-22
55
scheduled: true
66
---
77

@@ -20,93 +20,38 @@ import { RuleID } from "~/components";
2020
</tr>
2121
</thead>
2222
<tbody>
23-
<tr>
24-
<td>2025-09-15</td>
23+
<tr>
2524
<td>2025-09-22</td>
25+
<td>2025-09-29</td>
2626
<td>Log</td>
27-
<td>100800_BETA</td>
27+
<td>100717</td>
2828
<td>
29-
<RuleID id="199cce9ab21e40bcb535f01b2ee2085f" />
29+
<RuleID id="6fe90532af50427484a5275c8c2e30fb" />
3030
</td>
31-
<td>SQLi - Obfuscated Boolean - Beta</td>
32-
<td>This rule will be merged to 100800 in old WAF and 7663ea44178441a0b3205c145563445f in new WAF</td>
33-
</tr>
34-
<tr>
35-
<td>2025-09-15</td>
31+
<td>SimpleHelp - Auth Bypass - CVE:CVE-2024-57727 - Beta</td>
32+
<td>This rule will be merged to (ID: <RuleID id="498fcd81a62a4b5ca943e2de958094d3" /></td>
33+
</tr>
34+
<tr>
3635
<td>2025-09-22</td>
36+
<td>2025-09-29</td>
3737
<td>Log</td>
38-
<td>100146C</td>
38+
<td>100881</td>
3939
<td>
40-
<RuleID id="276073e60c7a4b4d91faba1fbbe18d50" />
40+
<RuleID id="68fc5c086ccb4b40a35a63b19bce1ff4" />
4141
</td>
42-
<td>SSRF - Cloud - 2</td>
42+
<td>WordPress:Plugin:Ditty - SSRF - CVE:CVE-2025-8085</td>
4343
<td>This is a New Detection</td>
4444
</tr>
4545
<tr>
46-
<td>2025-09-15</td>
4746
<td>2025-09-22</td>
47+
<td>2025-09-29</td>
4848
<td>Log</td>
49-
<td>100146</td>
49+
<td>100887</td>
5050
<td>
51-
<RuleID id="c36a425ae0c94789a9bc34f06a135cbf" />
51+
<RuleID id="9e1a56e6b3bc49b187bf6e35ddc329dd" />
5252
</td>
53-
<td>SSRF - Host - 2</td>
53+
<td>Vite - Directory Traversal - CVE:CVE-2025-30208</td>
5454
<td>This is a New Detection</td>
5555
</tr>
56-
<tr>
57-
<td>2025-09-15</td>
58-
<td>2025-09-22</td>
59-
<td>Log</td>
60-
<td>100146B</td>
61-
<td>
62-
<RuleID id="dfa84b0aed5a4b45b953a36a57035abf" />
63-
</td>
64-
<td>SSRF - Local - 2</td>
65-
<td>This is a New Detection</td>
66-
</tr>
67-
<tr>
68-
<td>2025-09-15</td>
69-
<td>2025-09-22</td>
70-
<td>Log</td>
71-
<td>100773</td>
72-
<td>
73-
<RuleID id="6be7e7829f3b43c688e1ac4284a619a1" />
74-
</td>
75-
<td>Next.js - SSRF</td>
76-
<td>This is a New Detection</td>
77-
</tr>
78-
<tr>
79-
<td>2025-09-15</td>
80-
<td>2025-09-22</td>
81-
<td>Log</td>
82-
<td>100758</td>
83-
<td>
84-
<RuleID id="9f1c8d4cbf3848dbb940771bc5ced231" />
85-
</td>
86-
<td>Skyvern - Remote Code Execution - CVE:CVE-2025-49619</td>
87-
<td>This is a New Detection</td>
88-
</tr>
89-
<tr>
90-
<td>2025-09-15</td>
91-
<td>2025-09-22</td>
92-
<td>Log</td>
93-
<td>100714</td>
94-
<td>
95-
<RuleID id="78c856218f2d40f4b5988c8c956c1961" />
96-
</td>
97-
<td>Azure - Auth Bypass - CVE:CVE-2025-54914</td>
98-
<td>This is a New Detection</td>
99-
</tr>
100-
<tr>
101-
<td>2025-09-15</td>
102-
<td>2025-09-22</td>
103-
<td>Log</td>
104-
<td>100774</td>
105-
<td>
106-
<RuleID id="0cc3f50216bf4b448210bcc3983ff2dd" />
107-
</td>
108-
<td>Adobe Commerce - Remote Code Execution - CVE:CVE-2025-54236</td>
109-
<td>This is a New Detection</td>
110-
</tr>
11156
</tbody>
11257
</table>

0 commit comments

Comments
 (0)