|
| 1 | +--- |
| 2 | +title: "WAF Release - 2025-08-18" |
| 3 | +description: Cloudflare WAF managed rulesets 2025-08-18 release |
| 4 | +date: 2025-08-18 |
| 5 | +--- |
| 6 | + |
| 7 | +import { RuleID } from "~/components"; |
| 8 | + |
| 9 | +This week's update |
| 10 | + |
| 11 | +This week, a series of critical vulnerabilities were discovered impacting core enterprise and open-source infrastructure. These flaws present a range of risks, providing attackers with distinct pathways for remote code execution, methods to breach internal network boundaries, and opportunities for critical data exposure and operational disruption. |
| 12 | + |
| 13 | + |
| 14 | +**Key Findings** |
| 15 | + |
| 16 | +- SonicWall SMA (CVE-2025-32819, CVE-2025-32820, CVE-2025-32821): A remote authenticated attacker with SSLVPN user privileges can bypass path traversal protections. These vulnerabilities enable a attacker to bypass security checks to read, modify, or delete arbitrary files. An attacker with administrative privileges can escalate this further, using a command injection flaw to upload malicious files, which could ultimately force the appliance to reboot to its factory default settings. |
| 17 | + |
| 18 | +- Ms-Swift Project (CVE-2025-50460): An unsafe deserialization vulnerability exists in the Ms-Swift project's handling of YAML configuration files.If an attacker can control the content of a configuration file passed to the application, they can embed a malicious payload that will execute arbitrary code and it can be executed during deserialization. |
| 19 | + |
| 20 | +- Apache Druid (CVE-2023-25194): This vulnerability in Apache Druid allows an attacker to cause the server to connect to a malicious LDAP server. By sending a specially crafted LDAP response, the attacker can trigger an unrestricted deserialization of untrusted data. If specific "gadgets" (classes that can be abused) are present in the server's classpath, this can be escalated to achieve Remote Code Execution (RCE). |
| 21 | + |
| 22 | +- Tenda AC8v4 (CVE-2025-51087, CVE-2025-51088): Vulnerabilities allow an authenticated attacker to trigger a stack-based buffer overflow. By sending malformed arguments in a request to specific endpoints, an attacker can crash the device or potentially achieve arbitrary code execution. |
| 23 | + |
| 24 | +- Open WebUI (CVE-2024-7959): This vulnerability allows a user to change the OpenAI URL endpoint to an arbitrary internal network address without proper validation. This flaw can be exploited to access internal services or cloud metadata endpoints, potentially leading to remote command execution if the attacker can retrieve instance secrets or access sensitive internal APIs. |
| 25 | + |
| 26 | +- BentoML (CVE-2025-54381): The vulnerability exists in the serialization/deserialization handlers for multipart form data and JSON requests, which automatically download files from user-provided URLs without proper validation of internal network addresses. This allowing attackers to fetch from unintended internal services—including cloud metadata and localhost. |
| 27 | + |
| 28 | +- Adobe Experience Manager Forms (CVE-2025-54254): AN Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read in Adobe AEM (≤6.5.23). |
| 29 | + |
| 30 | +**Impact** |
| 31 | + |
| 32 | +These vulnerabilities affect core infrastructure, from network security appliances like SonicWall to data platforms such as Apache Druid and ML frameworks like BentoML. The code execution and deserialization flaws are particularly severe, offering deep system access that allows attackers to steal data, disrupt services, and establish a foothold for broader intrusions. Simultaneously, SSRF and XXE vulnerabilities undermine network boundaries, exposing sensitive internal data and creating pathways for lateral movement. Beyond data-centric threats, flaws in edge devices like the Tenda router introduce the tangible risk of operational disruption, highlighting a multi-faceted threat to the security and stability of key enterprise systems. |
| 33 | + |
| 34 | +<table style="width: 100%"> |
| 35 | + <thead> |
| 36 | + <tr> |
| 37 | + <th>Ruleset</th> |
| 38 | + <th>Rule ID</th> |
| 39 | + <th>Legacy Rule ID</th> |
| 40 | + <th>Description</th> |
| 41 | + <th>Previous Action</th> |
| 42 | + <th>New Action</th> |
| 43 | + <th>Comments</th> |
| 44 | + </tr> |
| 45 | + </thead> |
| 46 | + <tbody> |
| 47 | + <tr> |
| 48 | + <td>Cloudflare Managed Ruleset</td> |
| 49 | + <td> |
| 50 | + <RuleID id="326ebb56d46a4c269bb699d3418d9a3b" /> |
| 51 | + </td> |
| 52 | + <td>100574</td> |
| 53 | + <td>SonicWall SMA - Remote Code Execution - CVE:CVE-2025-32819, CVE:CVE-2025-32820, CVE:CVE-2025-32821</td> |
| 54 | + <td>Log</td> |
| 55 | + <td>Disabled</td> |
| 56 | + <td>This is a New Detection</td> |
| 57 | + </tr> |
| 58 | + <tr> |
| 59 | + <td>Cloudflare Managed Ruleset</td> |
| 60 | + <td> |
| 61 | + <RuleID id="69f4f161dec04aca8a73a3231e6fefdb" /> |
| 62 | + </td> |
| 63 | + <td>100576</td> |
| 64 | + <td>Ms-Swift Project - Remote Code Execution - CVE:CVE-2025-50460</td> |
| 65 | + <td>Log</td> |
| 66 | + <td>Block</td> |
| 67 | + <td>This is a New Detection</td> |
| 68 | + </tr> |
| 69 | + <tr> |
| 70 | + <td>Cloudflare Managed Ruleset</td> |
| 71 | + <td> |
| 72 | + <RuleID id="d62935357ff846d9adefb58108ac45b3" /> |
| 73 | + </td> |
| 74 | + <td>100585</td> |
| 75 | + <td>Apache Druid - Remote Code Execution - CVE:CVE-2023-25194</td> |
| 76 | + <td>Log</td> |
| 77 | + <td>Block</td> |
| 78 | + <td>This is a New Detection</td> |
| 79 | + </tr> |
| 80 | + <tr> |
| 81 | + <td>Cloudflare Managed Ruleset</td> |
| 82 | + <td> |
| 83 | + <RuleID id="4f6148a760804bf8ad8ebccfe4855472" /> |
| 84 | + </td> |
| 85 | + <td>100834</td> |
| 86 | + <td>Tenda AC8v4 - Auth Bypass - CVE:CVE-2025-51087, CVE:CVE-2025-51088</td> |
| 87 | + <td>Log</td> |
| 88 | + <td>Block</td> |
| 89 | + <td>This is a New Detection</td> |
| 90 | + </tr> |
| 91 | + <tr> |
| 92 | + <td>Cloudflare Managed Ruleset</td> |
| 93 | + <td> |
| 94 | + <RuleID id="1474121b01ba40629f8246f8022ab542" /> |
| 95 | + </td> |
| 96 | + <td>100835</td> |
| 97 | + <td>Open WebUI - SSRF - CVE:CVE-2024-7959</td> |
| 98 | + <td>Log</td> |
| 99 | + <td>Block</td> |
| 100 | + <td>This is a New Detection</td> |
| 101 | + </tr> |
| 102 | + <tr> |
| 103 | + <td>Cloudflare Managed Ruleset</td> |
| 104 | + <td> |
| 105 | + <RuleID id="96abffdb7e224ce69ddf89eb6339f132" /> |
| 106 | + </td> |
| 107 | + <td>100837</td> |
| 108 | + <td>SQLi - OOB</td> |
| 109 | + <td>Log</td> |
| 110 | + <td>Block</td> |
| 111 | + <td>This is a New Detection</td> |
| 112 | + </tr> |
| 113 | + <tr> |
| 114 | + <td>Cloudflare Managed Ruleset</td> |
| 115 | + <td> |
| 116 | + <RuleID id="a0b20ec638d14800a1d6827cb83d2625" /> |
| 117 | + </td> |
| 118 | + <td>100841</td> |
| 119 | + <td>BentoML - SSRF - CVE:CVE-2025-54381</td> |
| 120 | + <td>Log</td> |
| 121 | + <td>Disabled</td> |
| 122 | + <td>This is a New Detection</td> |
| 123 | + </tr> |
| 124 | + <tr> |
| 125 | + <td>Cloudflare Managed Ruleset</td> |
| 126 | + <td> |
| 127 | + <RuleID id="40fd793035c947c5ac75add1739180d2" /> |
| 128 | + </td> |
| 129 | + <td>100841A</td> |
| 130 | + <td>BentoML - SSRF - CVE:CVE-2025-54381 - 2</td> |
| 131 | + <td>Log</td> |
| 132 | + <td>Disabled</td> |
| 133 | + <td>This is a New Detection</td> |
| 134 | + </tr> |
| 135 | + <tr> |
| 136 | + <td>Cloudflare Managed Ruleset</td> |
| 137 | + <td> |
| 138 | + <RuleID id="08dcb20b9acf47e3880a0b886ab910c2" /> |
| 139 | + </td> |
| 140 | + <td>100841B</td> |
| 141 | + <td>BentoML - SSRF - CVE:CVE-2025-54381 - 3</td> |
| 142 | + <td>Log</td> |
| 143 | + <td>Disabled</td> |
| 144 | + <td>This is a New Detection</td> |
| 145 | + </tr> |
| 146 | + <tr> |
| 147 | + <td>Cloudflare Managed Ruleset</td> |
| 148 | + <td> |
| 149 | + <RuleID id="309cfb7eeb42482e9ad896f12197ec51" /> |
| 150 | + </td> |
| 151 | + <td>100845</td> |
| 152 | + <td>Adobe Experience Manager Forms - XSS - CVE:CVE-2025-54254</td> |
| 153 | + <td>Log</td> |
| 154 | + <td>Block</td> |
| 155 | + <td>This is a New Detection</td> |
| 156 | + </tr> |
| 157 | + <tr> |
| 158 | + <td>Cloudflare Managed Ruleset</td> |
| 159 | + <td> |
| 160 | + <RuleID id="6e039776c2d6418ab6e8f05196f34ce3" /> |
| 161 | + </td> |
| 162 | + <td>100845A</td> |
| 163 | + <td>Adobe Experience Manager Forms - XSS - CVE:CVE-2025-54254 - 2</td> |
| 164 | + <td>Log</td> |
| 165 | + <td>Block</td> |
| 166 | + <td>This is a New Detection</td> |
| 167 | + </tr> |
| 168 | + </tbody> |
| 169 | +</table> |
0 commit comments