Skip to content

Commit febabb3

Browse files
fb1337thomasgauvin
fb1337
authored and
thomasgauvin
committed
WAF-Release-21-Jul-2025 (#23838)
1 parent 6fc1c96 commit febabb3

File tree

3 files changed

+148
-62
lines changed

3 files changed

+148
-62
lines changed

‎src/content/docs/waf/change-log/2025-07-21.mdx‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
---
2+
title: "2025-07-21"
3+
type: table
4+
pcx_content_type: release-notes
5+
sidebar:
6+
order: 782
7+
tableOfContents: false
8+
---
9+
10+
import { RuleID } from "~/components";
11+
12+
This week’s update spotlights several critical vulnerabilities across Citrix NetScaler Memory Disclosure, FTP servers and network application. Several flaws enable unauthenticated remote code execution or sensitive data exposure, posing a significant risk to enterprise security.
13+
14+
**Key Findings**
15+
16+
- Wing FTP Server (CVE-2025-47812): A critical Remote Code Execution (RCE) vulnerability that enables unauthenticated attackers to execute arbitrary code with root/SYSTEM-level privileges by exploiting a Lua injection flaw.
17+
- Infoblox NetMRI (CVE-2025-32813): A remote unauthenticated command injection flaw that allows an attacker to execute arbitrary commands, potentially leading to unauthorized access.
18+
- Citrix Netscaler ADC (CVE-2025-5777, CVE-2023-4966): A sensitive information disclosure vulnerability, also known as "Citrix Bleed2", that allows the disclosure of memory and subsequent remote access session hijacking.
19+
- Akamai CloudTest (CVE-2025-49493): An XML External Entity (XXE) injection that could lead to read local files on the system by manipulating XML input.
20+
21+
**Impact**
22+
23+
These vulnerabilities affect critical enterprise infrastructure, from file transfer services and network management appliances to application delivery controllers. The Wing FTP RCE and Infoblox command injection flaws offer direct paths to deep system compromise, while the Citrix "Bleed2" and Akamai XXE vulnerabilities undermine system integrity by enabling session hijacking and sensitive data theft.
24+
25+
<table style="width: 100%">
26+
<thead>
27+
<tr>
28+
<th>Ruleset</th>
29+
<th>Rule ID</th>
30+
<th>Legacy Rule ID</th>
31+
<th>Description</th>
32+
<th>Previous Action</th>
33+
<th>New Action</th>
34+
<th>Comments</th>
35+
</tr>
36+
</thead>
37+
<tbody>
38+
<tr>
39+
<td>Cloudflare Managed Ruleset</td>
40+
<td>
41+
<RuleID id="6ab3bd3b58fb4325ac2d3cc73461ec9e" />
42+
</td>
43+
<td>100804</td>
44+
<td>BerriAI - SSRF - CVE:CVE-2024-6587</td>
45+
<td>Log</td>
46+
<td>Log</td>
47+
<td>This is a New Detection</td>
48+
</tr>
49+
<tr>
50+
<td>Cloudflare Managed Ruleset</td>
51+
<td>
52+
<RuleID id="0e17d8761f1a47d5a744a75b5199b58a" />
53+
</td>
54+
<td>100805</td>
55+
<td>Wing FTP Server - Remote Code Execution - CVE:CVE-2025-47812</td>
56+
<td>Log</td>
57+
<td>Block</td>
58+
<td>This is a New Detection</td>
59+
</tr>
60+
<tr>
61+
<td>Cloudflare Managed Ruleset</td>
62+
<td>
63+
<RuleID id="81ace5a851214a2f9c58a1e7919a91a4" />
64+
</td>
65+
<td>100807</td>
66+
<td>Infoblox NetMRI - Command Injection - CVE:CVE-2025-32813</td>
67+
<td>Log</td>
68+
<td>Block</td>
69+
<td>This is a New Detection</td>
70+
</tr>
71+
<tr>
72+
<td>Cloudflare Managed Ruleset</td>
73+
<td>
74+
<RuleID id="cd8fa74e8f6f476c9380ae217899130f" />
75+
</td>
76+
<td>100808</td>
77+
<td>Citrix Netscaler ADC - Buffer Error - CVE:CVE-2025-5777</td>
78+
<td>Log</td>
79+
<td>Disabled</td>
80+
<td>This is a New Detection</td>
81+
</tr>
82+
<tr>
83+
<td>Cloudflare Managed Ruleset</td>
84+
<td>
85+
<RuleID id="e012c7bece304a1daf80935ed1cf8e08" />
86+
</td>
87+
<td>100809</td>
88+
<td>Citrix Netscaler ADC - Information Disclosure - CVE:CVE-2023-4966</td>
89+
<td>Log</td>
90+
<td>Block</td>
91+
<td>This is a New Detection</td>
92+
</tr>
93+
<tr>
94+
<td>Cloudflare Managed Ruleset</td>
95+
<td>
96+
<RuleID id="5d348a573a834ffd968faffc6e70469f" />
97+
</td>
98+
<td>100810</td>
99+
<td>Akamai CloudTest - XXE - CVE:CVE-2025-49493</td>
100+
<td>Log</td>
101+
<td>Block</td>
102+
<td>This is a New Detection</td>
103+
</tr>
104+
</tbody>
105+
</table>

‎src/content/docs/waf/change-log/scheduled-changes.mdx‎

Lines changed: 38 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -23,72 +23,50 @@ import { RSSButton, RuleID } from "~/components";
2323
<th>Comments</th>
2424
</tr>
2525
</thead>
26-
<tbody>
26+
<tbody>
2727
<tr>
28-
<td>2025-07-14</td>
29-
<td>2025-07-21</td>
30-
<td>Log</td>
31-
<td>100804</td>
32-
<td>
33-
<RuleID id="6ab3bd3b58fb4325ac2d3cc73461ec9e" />
34-
</td>
35-
<td>BerriAI - SSRF - CVE:CVE-2024-6587</td>
36-
<td>This is a New Detection</td>
37-
</tr>
38-
<tr>
39-
<td>2025-07-14</td>
40-
<td>2025-07-21</td>
41-
<td>Log</td>
42-
<td>100805</td>
43-
<td>
44-
<RuleID id="0e17d8761f1a47d5a744a75b5199b58a" />
45-
</td>
46-
<td>Wing FTP Server - Remote Code Execution - CVE:CVE-2025-47812</td>
47-
<td>This is a New Detection</td>
48-
</tr>
49-
<tr>
50-
<td>2025-07-14</td>
51-
<td>2025-07-21</td>
52-
<td>Log</td>
53-
<td>100807</td>
54-
<td>
55-
<RuleID id="81ace5a851214a2f9c58a1e7919a91a4" />
56-
</td>
57-
<td>Infoblox NetMRI - Command Injection - CVE:CVE-2025-32813</td>
58-
<td>This is a New Detection</td>
28+
<td>2025-07-21</td>
29+
<td>2025-07-28</td>
30+
<td>Log</td>
31+
<td>100812</td>
32+
<td>
33+
<RuleID id="2e6c4d02f42a4c3ca90649d50cb13e1d" />
34+
</td>
35+
<td>Fortinet FortiWeb - Remote Code Execution - CVE:CVE-2025-25257</td>
36+
<td>This is a New Detection</td>
5937
</tr>
6038
<tr>
61-
<td>2025-07-14</td>
62-
<td>2025-07-21</td>
63-
<td>Log</td>
64-
<td>100808</td>
65-
<td>
66-
<RuleID id="cd8fa74e8f6f476c9380ae217899130f" />
67-
</td>
68-
<td>Citrix Netscaler ADC - Buffer Error - CVE:CVE-2025-5777</td>
69-
<td>This is a New Detection</td>
39+
<td>2025-07-21</td>
40+
<td>2025-07-28</td>
41+
<td>Log</td>
42+
<td>100813</td>
43+
<td>
44+
<RuleID id="fd360d8fd9994e6bab6fb06067fae7f7" />
45+
</td>
46+
<td>Apache Tomcat - DoS - CVE:CVE-2025-31650</td>
47+
<td>This is a New Detection</td>
7048
</tr>
7149
<tr>
72-
<td>2025-07-14</td>
73-
<td>2025-07-21</td>
74-
<td>Log</td>
75-
<td>100809</td>
76-
<td>
77-
<RuleID id="e012c7bece304a1daf80935ed1cf8e08" />
78-
</td>
79-
<td>Citrix Netscaler ADC - Information Disclosure - CVE:CVE-2023-4966</td>
80-
<td>This is a New Detection</td>
50+
<td>2025-07-21</td>
51+
<td>2025-07-28</td>
52+
<td>Log</td>
53+
<td>100815</td>
54+
<td>
55+
<RuleID id="f9e01e28c5d6499cac66364b4b6a5bb1" />
56+
</td>
57+
<td>MongoDB - Remote Code Execution - CVE:CVE-2024-53900, CVE:CVE-2025-23061</td>
58+
<td>This is a New Detection</td>
8159
</tr>
8260
<tr>
83-
<td>2025-07-14</td>
84-
<td>2025-07-21</td>
85-
<td>Log</td>
86-
<td>100810</td>
87-
<td>
88-
<RuleID id="5d348a573a834ffd968faffc6e70469f" />
89-
</td>
90-
<td>Akamai CloudTest - XXE - CVE:CVE-2025-49493</td>
91-
<td>This is a New Detection</td>
61+
<td>2025-07-21</td>
62+
<td>2025-07-28</td>
63+
<td>Log</td>
64+
<td>100816</td>
65+
<td>
66+
<RuleID id="700d4fcc7b1f481a80cbeee5688f8e79" />
67+
</td>
68+
<td>MongoDB - Remote Code Execution - CVE:CVE-2024-53900, CVE:CVE-2025-23061</td>
69+
<td>This is a New Detection</td>
9270
</tr>
93-
</tbody>
71+
</tbody>
9472
</table>

‎src/content/release-notes/waf.yaml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,14 @@ productLink: "/waf/"
55
productArea: Application security
66
productAreaLink: /fundamentals/reference/changelog/security/
77
entries:
8-
- publish_date: "2025-07-14"
9-
scheduled_date: "2025-07-21"
8+
- publish_date: "2025-07-21"
9+
scheduled_date: "2025-07-28"
1010
individual_page: true
1111
scheduled: true
1212
link: "/waf/change-log/scheduled-changes/"
13+
- publish_date: "2025-07-21"
14+
individual_page: true
15+
link: "/waf/change-log/2025-07-21/"
1316
- publish_date: "2025-07-14"
1417
individual_page: true
1518
link: "/waf/change-log/2025-07-14/"

0 commit comments

Comments
 (0)