From a3b849ce00cfba56a68b0bd5da2f85ba736e6b59 Mon Sep 17 00:00:00 2001 From: vaibhav Date: Fri, 17 Oct 2025 11:51:34 -0700 Subject: [PATCH 1/4] Release-Oct-17-2025: Emergency --- .../waf/2025-10-17-emergency-waf-release.mdx | 229 ++++++++++++++++++ 1 file changed, 229 insertions(+) create mode 100644 src/content/changelog/waf/2025-10-17-emergency-waf-release.mdx diff --git a/src/content/changelog/waf/2025-10-17-emergency-waf-release.mdx b/src/content/changelog/waf/2025-10-17-emergency-waf-release.mdx new file mode 100644 index 000000000000000..aafb84195a1f463 --- /dev/null +++ b/src/content/changelog/waf/2025-10-17-emergency-waf-release.mdx @@ -0,0 +1,229 @@ +--- +title: "WAF Release - 2025-10-17 - Emergency" +description: Cloudflare WAF managed rulesets 2025-10-17 emergency release +date: 2025-10-17 +--- + +import { RuleID } from "~/components"; + +This week’s highlights This week introduces several new detections across Cloudflare Managed Rulesets, expanding coverage for high-impact vulnerability classes such as SSRF, SQLi, SSTI, Reverse Shell attempts, and Prototype Pollution. These rules aim to improve protection against attacker-controlled payloads that exploit misconfigurations or unvalidated input in web applications. + +**Key Findings** + +New detections added for multiple exploit categories: + +SSRF (Server-Side Request Forgery) — new rules targeting both local and cloud metadata abuse patterns (Beta). + +SQL Injection (SQLi) — rules for common patterns, sleep/time-based injections, and string/wait function exploitation across headers and URIs. + +SSTI (Server-Side Template Injection) — arithmetic-based probe detections introduced across URI, header, and body fields. + +Reverse Shell and XXE payloads — enhanced heuristics for command execution and XML external entity misuse. + +Prototype Pollution — new Beta rule identifying common JSON payload structures used in object prototype poisoning. + +PHP Wrapper Injection and HTTP Parameter Pollution detections — to catch path traversal and multi-parameter manipulation attempts. + +Anomaly Header Checks — detecting CRLF injection attempts in header names. + +**Impact** + +They help detect multi-vector payloads that blend SSRF + RCE or SQLi + SSTI attacks, especially in cloud-hosted applications with exposed metadata endpoints or unsafe template rendering. + +Prototype Pollution and HTTP parameter pollution rules address emerging JavaScript supply-chain exploitation patterns increasingly seen in real-world incidents. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
RulesetRule IDLegacy Rule IDDescriptionPrevious ActionNew ActionComments
Cloudflare Managed RulesetN/AAnomaly:Header - name - CR, LFN/ADisabledThis is a New Detection
Cloudflare Managed RulesetN/AGeneric Rules - Reverse Shell - BodyN/ADisabledThis is a New Detection
Cloudflare Managed RulesetN/AGeneric Rules - Reverse Shell - HeaderN/ADisabledThis is a New Detection
Cloudflare Managed RulesetN/AGeneric Rules - Reverse Shell - URIN/ADisabledThis is a New Detection
Cloudflare Managed RulesetN/AGeneric Rules - XXE - BodyN/ADisabledThis is a New Detection
Cloudflare Managed RulesetN/AGeneric Rules - SQLi - Common Patterns - Header URIN/ADisabledThis is a New Detection
Cloudflare Managed RulesetN/AGeneric Rules - SQLi - Sleep Function - Header URIN/ADisabledThis is a New Detection
Cloudflare Managed RulesetN/AGeneric Rules - SQLi - String Function - Header URIN/ADisabledThis is a New Detection
Cloudflare Managed RulesetN/AGeneric Rules - SQLi - WaitFor Function - Header URIN/ADisabledThis is a New Detection
Cloudflare Managed RulesetN/ASSRF - Local - BetaN/ADisabledThis is a New Detection
Cloudflare Managed RulesetN/ASSRF - Local - 2 - BetaN/ADisabledThis is a New Detection
Cloudflare Managed RulesetN/ASSRF - Cloud - BetaN/ADisabledThis is a New Detection
Cloudflare Managed RulesetN/ASSRF - Cloud - 2 - BetaN/ADisabledThis is a New Detection
Cloudflare Managed RulesetN/ASSTI - Arithmetic Probe - URIN/ADisabledThis is a New Detection
Cloudflare Managed RulesetN/ASSTI - Arithmetic Probe - HeaderN/ADisabledThis is a New Detection
Cloudflare Managed RulesetN/ASSTI - Arithmetic Probe - BodyN/ADisabledThis is a New Detection
Cloudflare Managed RulesetN/APHP Wrapper InjectionN/ADisabledThis is a New Detection
Cloudflare Managed RulesetN/APHP Wrapper InjectionN/ADisabledThis is a New Detection
Cloudflare Managed RulesetN/AHTTP parameter pollutionN/ADisabledThis is a New Detection
Cloudflare Managed RulesetN/APrototype Pollution - Common Payloads - BetaN/ADisabledThis is a New Detection
\ No newline at end of file From 27226793dc42fcfd9465d42347a384df784a800c Mon Sep 17 00:00:00 2001 From: "Haley C." <87731946+haleycode@users.noreply.github.com> Date: Fri, 17 Oct 2025 15:16:46 -0500 Subject: [PATCH 2/4] Update src/content/changelog/waf/2025-10-17-emergency-waf-release.mdx --- src/content/changelog/waf/2025-10-17-emergency-waf-release.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/changelog/waf/2025-10-17-emergency-waf-release.mdx b/src/content/changelog/waf/2025-10-17-emergency-waf-release.mdx index aafb84195a1f463..99ce77818b2b56d 100644 --- a/src/content/changelog/waf/2025-10-17-emergency-waf-release.mdx +++ b/src/content/changelog/waf/2025-10-17-emergency-waf-release.mdx @@ -28,7 +28,7 @@ Anomaly Header Checks — detecting CRLF injection attempts in header names. **Impact** -They help detect multi-vector payloads that blend SSRF + RCE or SQLi + SSTI attacks, especially in cloud-hosted applications with exposed metadata endpoints or unsafe template rendering. +These updates help detect multi-vector payloads that blend SSRF + RCE or SQLi + SSTI attacks, especially in cloud-hosted applications with exposed metadata endpoints or unsafe template rendering. Prototype Pollution and HTTP parameter pollution rules address emerging JavaScript supply-chain exploitation patterns increasingly seen in real-world incidents. From e7d863d8412493bc4de6222bb3084a9cee747b06 Mon Sep 17 00:00:00 2001 From: "Haley C." <87731946+haleycode@users.noreply.github.com> Date: Fri, 17 Oct 2025 15:16:56 -0500 Subject: [PATCH 3/4] Update src/content/changelog/waf/2025-10-17-emergency-waf-release.mdx --- .../changelog/waf/2025-10-17-emergency-waf-release.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/content/changelog/waf/2025-10-17-emergency-waf-release.mdx b/src/content/changelog/waf/2025-10-17-emergency-waf-release.mdx index 99ce77818b2b56d..99e3b3b422c3f0e 100644 --- a/src/content/changelog/waf/2025-10-17-emergency-waf-release.mdx +++ b/src/content/changelog/waf/2025-10-17-emergency-waf-release.mdx @@ -1,6 +1,6 @@ --- -title: "WAF Release - 2025-10-17 - Emergency" -description: Cloudflare WAF managed rulesets 2025-10-17 emergency release +title: New detections released for WAF managed rulesets +description: New Cloudflare WAF managed rulesets release to improve protection against attacker-controlled payloads date: 2025-10-17 --- From 7333a0420f145507a043de749683894fda9fad03 Mon Sep 17 00:00:00 2001 From: "Haley C." <87731946+haleycode@users.noreply.github.com> Date: Fri, 17 Oct 2025 15:17:03 -0500 Subject: [PATCH 4/4] Update src/content/changelog/waf/2025-10-17-emergency-waf-release.mdx --- src/content/changelog/waf/2025-10-17-emergency-waf-release.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/changelog/waf/2025-10-17-emergency-waf-release.mdx b/src/content/changelog/waf/2025-10-17-emergency-waf-release.mdx index 99e3b3b422c3f0e..3001df61385c0d0 100644 --- a/src/content/changelog/waf/2025-10-17-emergency-waf-release.mdx +++ b/src/content/changelog/waf/2025-10-17-emergency-waf-release.mdx @@ -6,7 +6,7 @@ date: 2025-10-17 import { RuleID } from "~/components"; -This week’s highlights This week introduces several new detections across Cloudflare Managed Rulesets, expanding coverage for high-impact vulnerability classes such as SSRF, SQLi, SSTI, Reverse Shell attempts, and Prototype Pollution. These rules aim to improve protection against attacker-controlled payloads that exploit misconfigurations or unvalidated input in web applications. +This week we introduced several new detections across Cloudflare Managed Rulesets, expanding coverage for high-impact vulnerability classes such as SSRF, SQLi, SSTI, Reverse Shell attempts, and Prototype Pollution. These rules aim to improve protection against attacker-controlled payloads that exploit misconfigurations or unvalidated input in web applications. **Key Findings**