Skip to content

Commit 3178142

Browse files
fb1337fb1337
committed
Release-1st-Sep-2025
1 parent 85242d3 commit 3178142

File tree

2 files changed

+153
-7
lines changed

2 files changed

+153
-7
lines changed

‎src/content/changelog/waf/2025-09-01-waf-release.mdx‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
---
2+
title: "WAF Release - 2025-09-01"
3+
description: Cloudflare WAF managed rulesets 2025-09-01 release
4+
date: 2025-09-01
5+
---
6+
7+
import { RuleID } from "~/components";
8+
9+
This week's update
10+
11+
This week, critical vulnerability was disclosed in Fortinet FortiWeb(versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below), linked to improper parameter handling that could allow unauthorized access.
12+
13+
14+
**Key Findings**
15+
16+
* Fortinet FortiWeb (CVE-2025-52970): A vulnerability may allow an unauthenticated remote attacker with access to non-public information to log in as any existing user on the device via a specially crafted request.
17+
18+
**Impact**
19+
Exploitation could allow an unauthenticated attacker to impersonate any existing user on the device, potentially enabling them to modify system settings or exfiltrate sensitive information, posing a serious security risk. Upgrading to the latest vendor-released version is strongly recommended.
20+
21+
22+
<table style="width: 100%">
23+
<thead>
24+
<tr>
25+
<th>Ruleset</th>
26+
<th>Rule ID</th>
27+
<th>Legacy Rule ID</th>
28+
<th>Description</th>
29+
<th>Previous Action</th>
30+
<th>New Action</th>
31+
<th>Comments</th>
32+
</tr>
33+
</thead>
34+
<tbody>
35+
<tr>
36+
<td>Cloudflare Managed Ruleset</td>
37+
<td>
38+
<RuleID id="636b145a49a84946b990d4fac49b7cf8" />
39+
</td>
40+
<td>100586</td>
41+
<td>Fortinet FortiWeb - Auth Bypass - CVE:CVE-2025-52970</td>
42+
<td>Log</td>
43+
<td>Disabled</td>
44+
<td>This is a New Detection</td>
45+
</tr>
46+
<tr>
47+
<td>Cloudflare Managed Ruleset</td>
48+
<td>
49+
<RuleID id="b5ef1ace353841a0856b5e07790c9dde" />
50+
</td>
51+
<td>100136C</td>
52+
<td>XSS - JavaScript - Headers and Body</td>
53+
<td>N/A</td>
54+
<td>N/A</td>
55+
<td>Rule metadata description refined. Detection unchanged.</td>
56+
</tr>
57+
</tbody>
58+
</table>

‎src/content/changelog/waf/scheduled-waf-release.mdx‎

Lines changed: 95 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
2-
title: WAF Release - Scheduled changes for 2025-09-01
3-
description: WAF managed ruleset changes scheduled for 2025-09-01
4-
date: 2025-08-25
2+
title: WAF Release - Scheduled changes for 2025-09-08
3+
description: WAF managed ruleset changes scheduled for 2025-09-08
4+
date: 2025-09-01
55
scheduled: true
66
---
77

@@ -21,14 +21,102 @@ import { RuleID } from "~/components";
2121
</thead>
2222
<tbody>
2323
<tr>
24-
<td>2025-08-25</td>
2524
<td>2025-09-01</td>
25+
<td>2025-09-08</td>
2626
<td>Log</td>
27-
<td>100586</td>
27+
<td>100007D</td>
2828
<td>
29-
<RuleID id="636b145a49a84946b990d4fac49b7cf8" />
29+
<RuleID id="7c5812a31fd94996b3299f7e963d7afc" />
3030
</td>
31-
<td>Fortinet FortiWeb - Auth Bypass - CVE:CVE-2025-52970</td>
31+
<td>Command Injection - Common Attack Commands Args</td>
32+
<td>Beta detection. This will be merged into the original rule "Command Injection - Common Attack Commands (id: 89557ce9b26e4d4dbf29e90c28345b9b)"</td>
33+
</tr>
34+
<tr>
35+
<td>2025-09-01</td>
36+
<td>2025-09-08</td>
37+
<td>Log</td>
38+
<td>100617</td>
39+
<td>
40+
<RuleID id="cd528243d6824f7ab56182988230a75b" />
41+
</td>
42+
<td>Next.js - SSRF - CVE:CVE-2025-57822</td>
43+
<td>This is a New Detection</td>
44+
</tr>
45+
<tr>
46+
<td>2025-09-01</td>
47+
<td>2025-09-08</td>
48+
<td>Log</td>
49+
<td>100659_BETA</td>
50+
<td>
51+
<RuleID id="503b337dac5c409d8f833a6ba22dabf1" />
52+
</td>
53+
<td>Common Payloads for Server-Side Template Injection - Beta</td>
54+
<td>Beta detection. This will be merged into the original rule “Common Payloads for Server-Side Template Injection (id: 21c7a963e1b749e7b1753238a28a42c4)"</td>
55+
</tr>
56+
<tr>
57+
<td>2025-09-01</td>
58+
<td>2025-09-08</td>
59+
<td>Log</td>
60+
<td>100824B</td>
61+
<td>
62+
<RuleID id="6d24266148f24f5e9fa487f8b416b7ca" />
63+
</td>
64+
<td>CrushFTP - Remote Code Execution - CVE:CVE-2025-54309 - 3</td>
65+
<td>This is a New Detection</td>
66+
</tr>
67+
<tr>
68+
<td>2025-09-01</td>
69+
<td>2025-09-08</td>
70+
<td>Log</td>
71+
<td>100848</td>
72+
<td>
73+
<RuleID id="154b217c43d04f11a13aeff05db1fa6b" />
74+
</td>
75+
<td>ScriptCase - Auth Bypass - CVE:CVE-2025-47227</td>
76+
<td>This is a New Detection</td>
77+
</tr>
78+
<tr>
79+
<td>2025-09-01</td>
80+
<td>2025-09-08</td>
81+
<td>Log</td>
82+
<td>100849</td>
83+
<td>
84+
<RuleID id="cad6f1c8c6d44ef59929e6532c62d330" />
85+
</td>
86+
<td>ScriptCase - Command Injection - CVE:CVE-2025-47228</td>
87+
<td>This is a New Detection</td>
88+
</tr>
89+
<tr>
90+
<td>2025-09-01</td>
91+
<td>2025-09-08</td>
92+
<td>Log</td>
93+
<td>100872</td>
94+
<td>
95+
<RuleID id="e7464139fd3e44938b56716bef971afd" />
96+
</td>
97+
<td>WordPress:Plugin:InfiniteWP Client - Missing Authorization - CVE:CVE-2020-8772</td>
98+
<td>This is a New Detection</td>
99+
</tr>
100+
<tr>
101+
<td>2025-09-01</td>
102+
<td>2025-09-08</td>
103+
<td>Log</td>
104+
<td>100873</td>
105+
<td>
106+
<RuleID id="0181ebb2cc234f2d863412e1bab19b0b" />
107+
</td>
108+
<td>Sar2HTML - Command Injection - CVE:CVE-2025-34030</td>
109+
<td>This is a New Detection</td>
110+
</tr>
111+
<tr>
112+
<td>2025-09-01</td>
113+
<td>2025-09-08</td>
114+
<td>Log</td>
115+
<td>100875</td>
116+
<td>
117+
<RuleID id="34d5c7c7b08b40eaad5b2bb3f24c0fbe" />
118+
</td>
119+
<td>Zhiyuan OA - Remote Code Execution - CVE:CVE-2025-34040</td>
32120
<td>This is a New Detection</td>
33121
</tr>
34122
</tbody>

0 commit comments

Comments
 (0)