Skip to content

Commit 35dad3b

Browse files
fb1337pedrosousa
fb1337
and
pedrosousa
authored
[WAF] MR Release 11th August, 2025 (#24310)
--------- Co-authored-by: Pedro Sousa <[email protected]>
1 parent e81ba26 commit 35dad3b

File tree

2 files changed

+325
-135
lines changed

2 files changed

+325
-135
lines changed

‎src/content/changelog/waf/2025-08-11-waf-release.mdx

Lines changed: 276 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,276 @@
1+
---
2+
title: "WAF Release - 2025-08-11"
3+
description: Cloudflare WAF managed rulesets 2025-08-11 release
4+
date: 2025-08-11
5+
---
6+
7+
import { RuleID } from "~/components";
8+
9+
This week's update focuses on a wide range of enterprise software, from network infrastructure and security platforms to content management systems and development frameworks. Flaws include unsafe deserialization, OS command injection, SSRF, authentication bypass, and arbitrary file upload — many of which allow unauthenticated remote code execution. Notable risks include Cisco Identity Services Engine and Ivanti EPMM, where successful exploitation could grant attackers full administrative control of core network infrastructure and popular web services such as WordPress, SharePoint, and Ingress-Nginx, where security bypasses and arbitrary file uploads could lead to complete site or server compromise.
10+
11+
12+
**Key Findings**
13+
14+
- Cisco Identity Services Engine (CVE-2025-20281): Insufficient input validation in a specific API of Cisco Identity Services Engine (ISE) and ISE-PIC allows an unauthenticated, remote attacker to execute arbitrary code with root privileges on an affected device.
15+
16+
- Wazuh Server (CVE-2025-24016): An unsafe deserialization vulnerability in Wazuh Server (versions 4.4.0 to 4.9.0) allows for remote code execution and privilege escalation. By injecting unsanitized data, an attacker can trigger an exception to execute arbitrary code on the server.
17+
18+
19+
- CrushFTP (CVE-2025-54309): A flaw in AS2 validation within CrushFTP allows remote attackers to gain administrative access via HTTPS on systems not using the DMZ proxy feature. This flaw can lead to unauthorized file access and potential system compromise.
20+
21+
22+
- Kentico Xperience CMS (CVE-2025-2747, CVE-2025-2748): Vulnerabilities in Kentico Xperience CMS could enable cross-site scripting (XSS), allowing attackers to inject malicious scripts into web pages. Additionally, a flaw could allow unauthenticated attackers to bypass the Staging Sync Server's authentication, potentially leading to administrative control over the CMS.
23+
24+
25+
- Node.js (CVE-2025-27210): An incomplete fix for a previous vulnerability (CVE-2025-23084) in Node.js affects the `path.join()` API method on Windows systems. The vulnerability can be triggered using reserved Windows device names such as `CON`, `PRN`, or `AUX`.
26+
27+
- WordPress:Plugin:Simple File List (CVE-2025-34085, CVE-2020-36847):
28+
This vulnerability in the Simple File List plugin for WordPress allows an unauthenticated remote attacker to upload arbitrary files to a vulnerable site. This can be exploited to achieve remote code execution on the server.<br/>
29+
(Note: CVE-2025-34085 has been rejected as a duplicate.)
30+
31+
32+
- GeoServer (CVE-2024-29198): A Server-Side Request Forgery (SSRF) vulnerability exists in GeoServer's Demo request endpoint, which can be exploited where the Proxy Base URL has not been configured.
33+
34+
- Ivanti EPMM (CVE-2025-6771): An OS command injection vulnerability in Ivanti Endpoint Manager Mobile (EPMM) before versions 12.5.0.2, 12.4.0.3, and 12.3.0.3 allows a remote, authenticated attacker with high privileges to execute arbitrary code.
35+
36+
- Microsoft SharePoint (CVE-2024-38018): This is a remote code execution vulnerability affecting Microsoft SharePoint Server.
37+
38+
- Manager-IO (CVE-2025-54122): A critical unauthenticated full read Server-Side Request Forgery (SSRF) vulnerability is present in the proxy handler of both Manager Desktop and Server editions up to version 25.7.18.2519. This allows an unauthenticated attacker to bypass network isolation and access internal services.
39+
40+
- Ingress-Nginx (CVE-2025-1974): A vulnerability in the Ingress-Nginx controller for Kubernetes allows an attacker to bypass access control rules. An unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller.
41+
42+
- PaperCut NG/MF (CVE-2023-2533): A Cross-Site Request Forgery (CSRF) vulnerability has been identified in PaperCut NG/MF. Under specific conditions, an attacker could exploit this to alter security settings or execute arbitrary code if they can deceive an administrator with an active login session into clicking a malicious link.
43+
44+
- SonicWall SMA (CVE-2025-40598): This vulnerability could allow an unauthenticated attacker to bypass security controls. This allows a remote, unauthenticated attacker to potentially execute arbitrary JavaScript code.
45+
46+
- WordPress (CVE-2025-5394): The "Alone – Charity Multipurpose Non-profit WordPress Theme" for WordPress is vulnerable to arbitrary file uploads. A missing capability check allows unauthenticated attackers to upload ZIP files containing webshells disguised as plugins, leading to remote code execution.
47+
48+
49+
**Impact**
50+
51+
These vulnerabilities span a broad range of enterprise technologies, including network access control systems, monitoring platforms, web servers, CMS platforms, cloud services, and collaboration tools. Exploitation techniques range from remote code execution and command injection to authentication bypass, SQL injection, path traversal, and configuration weaknesses.
52+
53+
A critical flaw in perimeter devices like Ivanti EPMM or SonicWall SMA could allow an unauthenticated attacker to gain remote code execution, completely breaching the primary network defense. A separate vulnerability within Cisco's Identity Services Engine could then be exploited to bypass network segmentation, granting an attacker widespread internal access. Insecure deserialization issues in platforms like Wazuh Server and CrushFTP could then be used to run malicious payloads or steal sensitive files from administrative consoles. Weaknesses in web delivery controllers like Ingress-Nginx or popular content management systems such as WordPress, SharePoint, and Kentico Xperience create vectors to bypass security controls, exfiltrate confidential data, or fully compromise servers.
54+
55+
<table style="width: 100%">
56+
<thead>
57+
<tr>
58+
<th>Ruleset</th>
59+
<th>Rule ID</th>
60+
<th>Legacy Rule ID</th>
61+
<th>Description</th>
62+
<th>Previous Action</th>
63+
<th>New Action</th>
64+
<th>Comments</th>
65+
</tr>
66+
</thead>
67+
<tbody>
68+
<tr>
69+
<td>Cloudflare Managed Ruleset</td>
70+
<td>
71+
<RuleID id="ec6480c81253494b947d891e51bc8df1" />
72+
</td>
73+
<td>100538</td>
74+
<td>GeoServer - SSRF - CVE:CVE-2024-29198</td>
75+
<td>Log</td>
76+
<td>Block</td>
77+
<td>This is a New Detection</td>
78+
</tr>
79+
<tr>
80+
<td>Cloudflare Managed Ruleset</td>
81+
<td>
82+
<RuleID id="b8cb07170b5e4c2b989119cac9e0b290" />
83+
</td>
84+
<td>100548</td>
85+
<td>Ivanti EPMM - Remote Code Execution - CVE:CVE-2025-6771</td>
86+
<td>Log</td>
87+
<td>Block</td>
88+
<td>This is a New Detection</td>
89+
</tr>
90+
<tr>
91+
<td>Cloudflare Managed Ruleset</td>
92+
<td>
93+
<RuleID id="b3524bf5f5174b65bc892122ad93cda8" />
94+
</td>
95+
<td>100550</td>
96+
<td>Microsoft SharePoint - Remote Code Execution - CVE:CVE-2024-38018</td>
97+
<td>Log</td>
98+
<td>Block</td>
99+
<td>This is a New Detection</td>
100+
</tr>
101+
<tr>
102+
<td>Cloudflare Managed Ruleset</td>
103+
<td>
104+
<RuleID id="e1369c5d629f4f10a14141381dca5738" />
105+
</td>
106+
<td>100562</td>
107+
<td>Manager-IO - SSRF - CVE:CVE-2025-54122</td>
108+
<td>Log</td>
109+
<td>Block</td>
110+
<td>This is a New Detection</td>
111+
</tr>
112+
<tr>
113+
<td>Cloudflare Managed Ruleset</td>
114+
<td>
115+
<RuleID id="136f67e2b6a84f15ab9a82a52e9137e1" />
116+
</td>
117+
<td>100565</td>
118+
<td>
119+
Cisco Identity Services Engine - Remote Code Execution -
120+
CVE:CVE-2025-20281
121+
</td>
122+
<td>Log</td>
123+
<td>Block</td>
124+
<td>This is a New Detection</td>
125+
</tr>
126+
<tr>
127+
<td>Cloudflare Managed Ruleset</td>
128+
<td>
129+
<RuleID id="ed759f7e44184fa398ef71785d8102e1" />
130+
</td>
131+
<td>100567</td>
132+
<td>Ingress-Nginx - Remote Code Execution - CVE:CVE-2025-1974</td>
133+
<td>Log</td>
134+
<td>Disabled</td>
135+
<td>This is a New Detection</td>
136+
</tr>
137+
<tr>
138+
<td>Cloudflare Managed Ruleset</td>
139+
<td>
140+
<RuleID id="71b8e7b646f94d79873213cd99105c43" />
141+
</td>
142+
<td>100569</td>
143+
<td>PaperCut NG/MF - Remote Code Execution - CVE:CVE-2023-2533</td>
144+
<td>Log</td>
145+
<td>Block</td>
146+
<td>This is a New Detection</td>
147+
</tr>
148+
<tr>
149+
<td>Cloudflare Managed Ruleset</td>
150+
<td>
151+
<RuleID id="2450bfbb0cfb4804b109d1c42c81dc88" />
152+
</td>
153+
<td>100571</td>
154+
<td>SonicWall SMA - XSS - CVE:CVE-2025-40598</td>
155+
<td>Log</td>
156+
<td>Block</td>
157+
<td>This is a New Detection</td>
158+
</tr>
159+
<tr>
160+
<td>Cloudflare Managed Ruleset</td>
161+
<td>
162+
<RuleID id="8ce1903b67e24205a93f5fe6926c96d4" />
163+
</td>
164+
<td>100573</td>
165+
<td>WordPress - Dangerous File Upload - CVE:CVE-2025-5394</td>
166+
<td>Log</td>
167+
<td>Block</td>
168+
<td>This is a New Detection</td>
169+
</tr>
170+
<tr>
171+
<td>Cloudflare Managed Ruleset</td>
172+
<td>
173+
<RuleID id="7fdb3c7bc7b74703aeef4ab240ec2fda" />
174+
</td>
175+
<td>100806</td>
176+
<td>Wazuh Server - Remote Code Execution - CVE:CVE-2025-24016</td>
177+
<td>Log</td>
178+
<td>Block</td>
179+
<td>This is a New Detection</td>
180+
</tr>
181+
<tr>
182+
<td>Cloudflare Managed Ruleset</td>
183+
<td>
184+
<RuleID id="fe088163f51f4928a3c8d91e2401fa3b" />
185+
</td>
186+
<td>100824</td>
187+
<td>CrushFTP - Remote Code Execution - CVE:CVE-2025-54309</td>
188+
<td>Log</td>
189+
<td>Block</td>
190+
<td>This is a New Detection</td>
191+
</tr>
192+
<tr>
193+
<td>Cloudflare Managed Ruleset</td>
194+
<td>
195+
<RuleID id="3638baed75924604987b86d874920ace" />
196+
</td>
197+
<td>100824A</td>
198+
<td>CrushFTP - Remote Code Execution - CVE:CVE-2025-54309 - 2</td>
199+
<td>Log</td>
200+
<td>Block</td>
201+
<td>This is a New Detection</td>
202+
</tr>
203+
<tr>
204+
<td>Cloudflare Managed Ruleset</td>
205+
<td>
206+
<RuleID id="dda4f95b3a3e4ebb9e194aa5c7e63549" />
207+
</td>
208+
<td>100825</td>
209+
<td>AMI MegaRAC - Auth Bypass - CVE:CVE-2024-54085</td>
210+
<td>Log</td>
211+
<td>Block</td>
212+
<td>This is a New Detection</td>
213+
</tr>
214+
<tr>
215+
<td>Cloudflare Managed Ruleset</td>
216+
<td>
217+
<RuleID id="7dc07014cefa4ce9adf21da7b79037e6" />
218+
</td>
219+
<td>100826</td>
220+
<td>Kentico Xperience CMS - Auth Bypass - CVE:CVE-2025-2747</td>
221+
<td>Log</td>
222+
<td>Block</td>
223+
<td>This is a New Detection</td>
224+
</tr>
225+
<tr>
226+
<td>Cloudflare Managed Ruleset</td>
227+
<td>
228+
<RuleID id="7c7a0a37e79a4949ba840c9acaf261aa" />
229+
</td>
230+
<td>100827</td>
231+
<td>Kentico Xperience CMS - XSS - CVE:CVE-2025-2748</td>
232+
<td>Log</td>
233+
<td>Block</td>
234+
<td>This is a New Detection</td>
235+
</tr>
236+
<tr>
237+
<td>Cloudflare Managed Ruleset</td>
238+
<td>
239+
<RuleID id="54dd826f578c483196ce852b6f1c2d12" />
240+
</td>
241+
<td>100828</td>
242+
<td>Node.js - Directory Traversal - CVE:CVE-2025-27210</td>
243+
<td>Log</td>
244+
<td>Block</td>
245+
<td>This is a New Detection</td>
246+
</tr>
247+
<tr>
248+
<td>Cloudflare Managed Ruleset</td>
249+
<td>
250+
<RuleID id="a2867f7456c14213a94509a40341fccc" />
251+
</td>
252+
<td>100829</td>
253+
<td>
254+
WordPress:Plugin:Simple File List - Remote Code Execution -
255+
CVE:CVE-2025-34085
256+
</td>
257+
<td>Log</td>
258+
<td>Block</td>
259+
<td>This is a New Detection</td>
260+
</tr>
261+
<tr>
262+
<td>Cloudflare Managed Ruleset</td>
263+
<td>
264+
<RuleID id="4cdb0e792d1a428a897526624cefeeda" />
265+
</td>
266+
<td>100829A</td>
267+
<td>
268+
WordPress:Plugin:Simple File List - Remote Code Execution -
269+
CVE:CVE-2025-34085 - 2
270+
</td>
271+
<td>Log</td>
272+
<td>Disabled</td>
273+
<td>This is a New Detection</td>
274+
</tr>
275+
</tbody>
276+
</table>

0 commit comments

Comments
 (0)