Skip to content

Commit 3414101

Browse files
vs-mgvs-mg
authored
Release-Sep-15-2025 (#25168)
1 parent da4d599 commit 3414101

File tree

2 files changed

+145
-16
lines changed

2 files changed

+145
-16
lines changed

‎src/content/changelog/waf/2025-09-15-waf-release.mdx‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
---
2+
title: "WAF Release - 2025-09-15"
3+
description: Cloudflare WAF managed rulesets 2025-09-15 release
4+
date: 2025-09-15
5+
---
6+
7+
import { RuleID } from "~/components";
8+
9+
**This week's update**
10+
11+
This week’s focus highlights newly disclosed vulnerabilities in DevOps tooling, data visualization platforms, and enterprise CMS solutions. These issues include sensitive information disclosure and remote code execution, putting organizations at risk of credential leakage, unauthorized access, and full system compromise.
12+
13+
**Key Findings**
14+
15+
* Argo CD (CVE-2025-55190): Exposure of sensitive information could allow attackers to access credential data stored in configurations, potentially leading to compromise of Kubernetes workloads and secrets.Next.js (CVE-2025-57822): Improper handling of redirects in custom middleware can lead to server-side request forgery (SSRF) when user-supplied headers are forwarded. Attackers could exploit this to access internal services or cloud metadata endpoints. The issue has been resolved in versions 14.2.32 and 15.4.7. Developers using custom middleware should upgrade and verify proper redirect handling in `next()` calls.
16+
17+
* DataEase (CVE-2025-57773): Insufficient input validation enables JNDI injection and insecure deserialization, resulting in remote code execution (RCE). Successful exploitation grants attackers control over the application server.
18+
19+
* Sitecore (CVE-2025-53694): A sensitive information disclosure flaw allows unauthorized access to confidential information stored in Sitecore deployments, raising the risk of data breaches and privilege escalation.
20+
21+
**Impact**
22+
23+
These vulnerabilities expose organizations to serious risks, including credential theft, unauthorized access, and full system compromise. Argo CD’s flaw may expose Kubernetes secrets, DataEase exploitation could give attackers remote execution capabilities, and Sitecore’s disclosure issue increases the likelihood of sensitive data leakage and business impact.
24+
25+
Administrators are strongly advised to apply vendor patches immediately, rotate exposed credentials, and review access controls to mitigate these risks.
26+
27+
<table style="width: 100%">
28+
<thead>
29+
<tr>
30+
<th>Ruleset</th>
31+
<th>Rule ID</th>
32+
<th>Legacy Rule ID</th>
33+
<th>Description</th>
34+
<th>Previous Action</th>
35+
<th>New Action</th>
36+
<th>Comments</th>
37+
</tr>
38+
</thead>
39+
<tbody>
40+
<tr>
41+
<td>Cloudflare Managed Ruleset</td>
42+
<td>
43+
<RuleID id="199cce9ab21e40bcb535f01b2ee2085f" />
44+
</td>
45+
<td>100646</td>
46+
<td>Argo CD - Information Disclosure - CVE:CVE-2025-55190s</td>
47+
<td>Log</td>
48+
<td>Disabled</td>
49+
<td>This is a New Detection</td>
50+
</tr>
51+
<tr>
52+
<td>Cloudflare Managed Ruleset</td>
53+
<td>
54+
<RuleID id="e513bb21b6a44f9cbfcd2462f5e20788" />
55+
</td>
56+
<td>100874</td>
57+
<td>DataEase - JNDI injection - CVE:CVE-2025-57773</td>
58+
<td>Log</td>
59+
<td>Disabled</td>
60+
<td>This is a New Detection</td>
61+
</tr>
62+
<tr>
63+
<td>Cloudflare Managed Ruleset</td>
64+
<td>
65+
<RuleID id="be097f5a71a04f27aa87b60d005a12fd" />
66+
</td>
67+
<td>100880</td>
68+
<td>Sitecore - Information Disclosure - CVE:CVE-2025-53694</td>
69+
<td>Log</td>
70+
<td>Block</td>
71+
<td>This is a New Detection</td>
72+
</tr>
73+
</tbody>
74+
</table>

‎src/content/changelog/waf/scheduled-waf-release.mdx‎

Lines changed: 71 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
2-
title: WAF Release - Scheduled changes for 2025-09-15
3-
description: WAF managed ruleset changes scheduled for 2025-09-15
4-
date: 2025-09-08
2+
title: WAF Release - Scheduled changes for 2025-09-22
3+
description: WAF managed ruleset changes scheduled for 2025-09-22
4+
date: 2025-09-15
55
scheduled: true
66
---
77

@@ -21,37 +21,92 @@ import { RuleID } from "~/components";
2121
</thead>
2222
<tbody>
2323
<tr>
24-
<td>2025-09-08</td>
2524
<td>2025-09-15</td>
25+
<td>2025-09-22</td>
2626
<td>Log</td>
27-
<td>100646</td>
27+
<td>100800_BETA</td>
2828
<td>
2929
<RuleID id="199cce9ab21e40bcb535f01b2ee2085f" />
3030
</td>
31-
<td>Argo CD - Information Disclosure - CVE:CVE-2025-55190</td>
32-
<td>This is a New Detection</td>
31+
<td>SQLi - Obfuscated Boolean - Beta</td>
32+
<td>This rule will be merged to 100800 in old WAF and 7663ea44178441a0b3205c145563445f in new WAF</td>
3333
</tr>
3434
<tr>
35-
<td>2025-09-08</td>
3635
<td>2025-09-15</td>
36+
<td>2025-09-22</td>
3737
<td>Log</td>
38-
<td>100874</td>
38+
<td>100146C</td>
3939
<td>
40-
<RuleID id="e513bb21b6a44f9cbfcd2462f5e20788" />
40+
<RuleID id="276073e60c7a4b4d91faba1fbbe18d50" />
4141
</td>
42-
<td>DataEase - JNDI injection - CVE:CVE-2025-57773</td>
42+
<td>SSRF - Cloud - 2</td>
4343
<td>This is a New Detection</td>
4444
</tr>
4545
<tr>
46-
<td>2025-09-08</td>
4746
<td>2025-09-15</td>
47+
<td>2025-09-22</td>
4848
<td>Log</td>
49-
<td>100880</td>
49+
<td>100146</td>
5050
<td>
51-
<RuleID id="be097f5a71a04f27aa87b60d005a12fd" />
51+
<RuleID id="c36a425ae0c94789a9bc34f06a135cbf" />
5252
</td>
53-
<td>Sitecore - Information Disclosure - CVE:CVE-2025-53694</td>
53+
<td>SSRF - Host - 2</td>
5454
<td>This is a New Detection</td>
55-
</tr>
55+
</tr>
56+
<tr>
57+
<td>2025-09-15</td>
58+
<td>2025-09-22</td>
59+
<td>Log</td>
60+
<td>100146B</td>
61+
<td>
62+
<RuleID id="dfa84b0aed5a4b45b953a36a57035abf" />
63+
</td>
64+
<td>SSRF - Local - 2</td>
65+
<td>This is a New Detection</td>
66+
</tr>
67+
<tr>
68+
<td>2025-09-15</td>
69+
<td>2025-09-22</td>
70+
<td>Log</td>
71+
<td>100773</td>
72+
<td>
73+
<RuleID id="6be7e7829f3b43c688e1ac4284a619a1" />
74+
</td>
75+
<td>Next.js - SSRF</td>
76+
<td>This is a New Detection</td>
77+
</tr>
78+
<tr>
79+
<td>2025-09-15</td>
80+
<td>2025-09-22</td>
81+
<td>Log</td>
82+
<td>100758</td>
83+
<td>
84+
<RuleID id="9f1c8d4cbf3848dbb940771bc5ced231" />
85+
</td>
86+
<td>Skyvern - Remote Code Execution - CVE:CVE-2025-49619</td>
87+
<td>This is a New Detection</td>
88+
</tr>
89+
<tr>
90+
<td>2025-09-15</td>
91+
<td>2025-09-22</td>
92+
<td>Log</td>
93+
<td>100714</td>
94+
<td>
95+
<RuleID id="78c856218f2d40f4b5988c8c956c1961" />
96+
</td>
97+
<td>Azure - Auth Bypass - CVE:CVE-2025-54914</td>
98+
<td>This is a New Detection</td>
99+
</tr>
100+
<tr>
101+
<td>2025-09-15</td>
102+
<td>2025-09-22</td>
103+
<td>Log</td>
104+
<td>100774</td>
105+
<td>
106+
<RuleID id="0cc3f50216bf4b448210bcc3983ff2dd" />
107+
</td>
108+
<td>Adobe Commerce - Remote Code Execution - CVE:CVE-2025-54236</td>
109+
<td>This is a New Detection</td>
110+
</tr>
56111
</tbody>
57112
</table>

0 commit comments

Comments
 (0)