Skip to content

Commit 85b050d

Browse files
vs-mghaleycode
vs-mg
and
haleycode
authored
Release-Oct-17-2025: Emergency (#25908)
* Release-Oct-17-2025: Emergency * Update src/content/changelog/waf/2025-10-17-emergency-waf-release.mdx * Update src/content/changelog/waf/2025-10-17-emergency-waf-release.mdx * Update src/content/changelog/waf/2025-10-17-emergency-waf-release.mdx --------- Co-authored-by: Haley C. <[email protected]>
1 parent 51eb10b commit 85b050d

File tree

1 file changed

+229
-0
lines changed

1 file changed

+229
-0
lines changed

‎src/content/changelog/waf/2025-10-17-emergency-waf-release.mdx‎

Lines changed: 229 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,229 @@
1+
---
2+
title: New detections released for WAF managed rulesets
3+
description: New Cloudflare WAF managed rulesets release to improve protection against attacker-controlled payloads
4+
date: 2025-10-17
5+
---
6+
7+
import { RuleID } from "~/components";
8+
9+
This week we introduced several new detections across Cloudflare Managed Rulesets, expanding coverage for high-impact vulnerability classes such as SSRF, SQLi, SSTI, Reverse Shell attempts, and Prototype Pollution. These rules aim to improve protection against attacker-controlled payloads that exploit misconfigurations or unvalidated input in web applications.
10+
11+
**Key Findings**
12+
13+
New detections added for multiple exploit categories:
14+
15+
SSRF (Server-Side Request Forgery) — new rules targeting both local and cloud metadata abuse patterns (Beta).
16+
17+
SQL Injection (SQLi) — rules for common patterns, sleep/time-based injections, and string/wait function exploitation across headers and URIs.
18+
19+
SSTI (Server-Side Template Injection) — arithmetic-based probe detections introduced across URI, header, and body fields.
20+
21+
Reverse Shell and XXE payloads — enhanced heuristics for command execution and XML external entity misuse.
22+
23+
Prototype Pollution — new Beta rule identifying common JSON payload structures used in object prototype poisoning.
24+
25+
PHP Wrapper Injection and HTTP Parameter Pollution detections — to catch path traversal and multi-parameter manipulation attempts.
26+
27+
Anomaly Header Checks — detecting CRLF injection attempts in header names.
28+
29+
**Impact**
30+
31+
These updates help detect multi-vector payloads that blend SSRF + RCE or SQLi + SSTI attacks, especially in cloud-hosted applications with exposed metadata endpoints or unsafe template rendering.
32+
33+
Prototype Pollution and HTTP parameter pollution rules address emerging JavaScript supply-chain exploitation patterns increasingly seen in real-world incidents.
34+
35+
<table style="width: 100%">
36+
<thead>
37+
<tr>
38+
<th>Ruleset</th>
39+
<th>Rule ID</th>
40+
<th>Legacy Rule ID</th>
41+
<th>Description</th>
42+
<th>Previous Action</th>
43+
<th>New Action</th>
44+
<th>Comments</th>
45+
</tr>
46+
</thead>
47+
<tbody>
48+
<tr>
49+
<td>Cloudflare Managed Ruleset</td>
50+
<td><RuleID id="72f0ff933fb0492eb71cda50589f2a1d" /></td>
51+
<td>N/A</td>
52+
<td>Anomaly:Header - name - CR, LF</td>
53+
<td>N/A</td>
54+
<td>Disabled</td>
55+
<td>This is a New Detection</td>
56+
</tr>
57+
<tr>
58+
<td>Cloudflare Managed Ruleset</td>
59+
<td><RuleID id="5d0377e4435f467488614170132fab7e" /></td>
60+
<td>N/A</td>
61+
<td>Generic Rules - Reverse Shell - Body</td>
62+
<td>N/A</td>
63+
<td>Disabled</td>
64+
<td>This is a New Detection</td>
65+
</tr>
66+
<tr>
67+
<td>Cloudflare Managed Ruleset</td>
68+
<td><RuleID id="54e32f7f802c4a699182e8921a027008" /></td>
69+
<td>N/A</td>
70+
<td>Generic Rules - Reverse Shell - Header</td>
71+
<td>N/A</td>
72+
<td>Disabled</td>
73+
<td>This is a New Detection</td>
74+
</tr>
75+
<tr>
76+
<td>Cloudflare Managed Ruleset</td>
77+
<td><RuleID id="7cbda8dbafbc465d9b64a8f2958d0486" /></td>
78+
<td>N/A</td>
79+
<td>Generic Rules - Reverse Shell - URI</td>
80+
<td>N/A</td>
81+
<td>Disabled</td>
82+
<td>This is a New Detection</td>
83+
</tr>
84+
<tr>
85+
<td>Cloudflare Managed Ruleset</td>
86+
<td><RuleID id="b9f3420674cf481da32333dc8e0cf7ad" /></td>
87+
<td>N/A</td>
88+
<td>Generic Rules - XXE - Body</td>
89+
<td>N/A</td>
90+
<td>Disabled</td>
91+
<td>This is a New Detection</td>
92+
</tr>
93+
<tr>
94+
<td>Cloudflare Managed Ruleset</td>
95+
<td><RuleID id="ad55483512f0440b81426acdbf8aab5e" /></td>
96+
<td>N/A</td>
97+
<td>Generic Rules - SQLi - Common Patterns - Header URI</td>
98+
<td>N/A</td>
99+
<td>Disabled</td>
100+
<td>This is a New Detection</td>
101+
</tr>
102+
<tr>
103+
<td>Cloudflare Managed Ruleset</td>
104+
<td><RuleID id="849c0618d1674f1c92ba6f9b2e466337" /></td>
105+
<td>N/A</td>
106+
<td>Generic Rules - SQLi - Sleep Function - Header URI</td>
107+
<td>N/A</td>
108+
<td>Disabled</td>
109+
<td>This is a New Detection</td>
110+
</tr>
111+
<tr>
112+
<td>Cloudflare Managed Ruleset</td>
113+
<td><RuleID id="1b4db4c4bd0649c095c27c6cb686ab47" /></td>
114+
<td>N/A</td>
115+
<td>Generic Rules - SQLi - String Function - Header URI</td>
116+
<td>N/A</td>
117+
<td>Disabled</td>
118+
<td>This is a New Detection</td>
119+
</tr>
120+
<tr>
121+
<td>Cloudflare Managed Ruleset</td>
122+
<td><RuleID id="fa2055b84af94ba4b925f834b0633709" /></td>
123+
<td>N/A</td>
124+
<td>Generic Rules - SQLi - WaitFor Function - Header URI</td>
125+
<td>N/A</td>
126+
<td>Disabled</td>
127+
<td>This is a New Detection</td>
128+
</tr>
129+
<tr>
130+
<td>Cloudflare Managed Ruleset</td>
131+
<td><RuleID id="158177dec2504acdba1f2da201a076eb" /></td>
132+
<td>N/A</td>
133+
<td>SSRF - Local - Beta</td>
134+
<td>N/A</td>
135+
<td>Disabled</td>
136+
<td>This is a New Detection</td>
137+
</tr>
138+
<tr>
139+
<td>Cloudflare Managed Ruleset</td>
140+
<td><RuleID id="98bfd6bb46074d5b8d1c4b39743a63ec" /></td>
141+
<td>N/A</td>
142+
<td>SSRF - Local - 2 - Beta</td>
143+
<td>N/A</td>
144+
<td>Disabled</td>
145+
<td>This is a New Detection</td>
146+
</tr>
147+
<tr>
148+
<td>Cloudflare Managed Ruleset</td>
149+
<td><RuleID id="54e1733b10da4a599e06c6fbc2e84e2d" /></td>
150+
<td>N/A</td>
151+
<td>SSRF - Cloud - Beta</td>
152+
<td>N/A</td>
153+
<td>Disabled</td>
154+
<td>This is a New Detection</td>
155+
</tr>
156+
<tr>
157+
<td>Cloudflare Managed Ruleset</td>
158+
<td><RuleID id="ecd26d61a75e46f6a4449a06ab8af26f" /></td>
159+
<td>N/A</td>
160+
<td>SSRF - Cloud - 2 - Beta</td>
161+
<td>N/A</td>
162+
<td>Disabled</td>
163+
<td>This is a New Detection</td>
164+
</tr>
165+
<tr>
166+
<td>Cloudflare Managed Ruleset</td>
167+
<td><RuleID id="c16f4e133c4541f293142d02e6e8dc5b" /></td>
168+
<td>N/A</td>
169+
<td>SSTI - Arithmetic Probe - URI</td>
170+
<td>N/A</td>
171+
<td>Disabled</td>
172+
<td>This is a New Detection</td>
173+
</tr>
174+
<tr>
175+
<td>Cloudflare Managed Ruleset</td>
176+
<td><RuleID id="f4fd9904e7624666b8c49cd62550d794" /></td>
177+
<td>N/A</td>
178+
<td>SSTI - Arithmetic Probe - Header</td>
179+
<td>N/A</td>
180+
<td>Disabled</td>
181+
<td>This is a New Detection</td>
182+
</tr>
183+
<tr>
184+
<td>Cloudflare Managed Ruleset</td>
185+
<td><RuleID id="5c0875604f774c36a4f9b69c659d12a6" /></td>
186+
<td>N/A</td>
187+
<td>SSTI - Arithmetic Probe - Body</td>
188+
<td>N/A</td>
189+
<td>Disabled</td>
190+
<td>This is a New Detection</td>
191+
</tr>
192+
<tr>
193+
<td>Cloudflare Managed Ruleset</td>
194+
<td><RuleID id="fae6fa37ae9249d58628e54b1a3e521e" /></td>
195+
<td>N/A</td>
196+
<td>PHP Wrapper Injection</td>
197+
<td>N/A</td>
198+
<td>Disabled</td>
199+
<td>This is a New Detection</td>
200+
</tr>
201+
<tr>
202+
<td>Cloudflare Managed Ruleset</td>
203+
<td><RuleID id="9c02e585db34440da620eb668f76bd74" /></td>
204+
<td>N/A</td>
205+
<td>PHP Wrapper Injection</td>
206+
<td>N/A</td>
207+
<td>Disabled</td>
208+
<td>This is a New Detection</td>
209+
</tr>
210+
<tr>
211+
<td>Cloudflare Managed Ruleset</td>
212+
<td><RuleID id="cb67fe56a84747b8b64277dc091e296d" /></td>
213+
<td>N/A</td>
214+
<td>HTTP parameter pollution</td>
215+
<td>N/A</td>
216+
<td>Disabled</td>
217+
<td>This is a New Detection</td>
218+
</tr>
219+
<tr>
220+
<td>Cloudflare Managed Ruleset</td>
221+
<td><RuleID id="443b54d984944cd69043805ee34214ef" /></td>
222+
<td>N/A</td>
223+
<td>Prototype Pollution - Common Payloads - Beta</td>
224+
<td>N/A</td>
225+
<td>Disabled</td>
226+
<td>This is a New Detection</td>
227+
</tr>
228+
</tbody>
229+
</table>

0 commit comments

Comments
 (0)