|
| 1 | +--- |
| 2 | +title: "WAF Release - 2025-09-29" |
| 3 | +description: Cloudflare WAF managed rulesets 2025-09-29 release |
| 4 | +date: 2025-09-29 |
| 5 | +--- |
| 6 | + |
| 7 | +import { RuleID } from "~/components"; |
| 8 | + |
| 9 | +This week highlights four important vendor- and component-specific issues: an authentication bypass in SimpleHelp (CVE-2024-57727), an information-disclosure flaw in Flowise Cloud (CVE-2025-58434), an SSRF in the WordPress plugin Ditty (CVE-2025-8085), and a directory-traversal bug in Vite (CVE-2025-30208). These are paired with improvements to our generic detection coverage (SQLi, SSRF) to raise the baseline and reduce noisy gaps. |
| 10 | + |
| 11 | +**Key Findings** |
| 12 | + |
| 13 | +* SimpleHelp (CVE-2024-57727): Authentication bypass in SimpleHelp that can allow unauthorized access to management interfaces or sessions. |
| 14 | + |
| 15 | +* Flowise Cloud (CVE-2025-58434): Information-disclosure vulnerability in Flowise Cloud that may expose sensitive configuration or user data to unauthenticated or low-privileged actors. |
| 16 | + |
| 17 | +* WordPress:Plugin: Ditty (CVE-2025-8085): SSRF in the Ditty WordPress plugin enabling server-side requests that could reach internal services or cloud metadata endpoints. |
| 18 | + |
| 19 | +* Vite (CVE-2025-30208): Directory-traversal vulnerability in Vite allowing access to filesystem paths outside the intended web root. |
| 20 | + |
| 21 | +**Impact** |
| 22 | + |
| 23 | +These vulnerabilities allow attackers to gain access, escalate privileges, or execute actions that were previously unavailable: |
| 24 | + |
| 25 | +* SimpleHelp (CVE-2024-57727): An authentication bypass that can let unauthenticated attackers access management interfaces or hijack sessions — enabling lateral movement, credential theft, or privilege escalation within affected environments. |
| 26 | + |
| 27 | +* Flowise Cloud (CVE-2025-58434): Information-disclosure flaw that can expose sensitive configuration, tokens, or user data; leaked secrets may be chained into account takeover or privileged access to backend services. |
| 28 | + |
| 29 | +* WordPress:Plugin: Ditty (CVE-2025-8085): SSRF that enables server-side requests to internal services or cloud metadata endpoints, potentially allowing attackers to retrieve credentials or reach otherwise inaccessible infrastructure, leading to privilege escalation or cloud resource compromise. |
| 30 | + |
| 31 | +* Vite (CVE-2025-30208): Directory-traversal vulnerability that can expose filesystem contents outside the web root (configuration files, keys, source code), which attackers can use to escalate privileges or further compromise systems. |
| 32 | + |
| 33 | +<table style="width: 100%"> |
| 34 | + <thead> |
| 35 | + <tr> |
| 36 | + <th>Ruleset</th> |
| 37 | + <th>Rule ID</th> |
| 38 | + <th>Legacy Rule ID</th> |
| 39 | + <th>Description</th> |
| 40 | + <th>Previous Action</th> |
| 41 | + <th>New Action</th> |
| 42 | + <th>Comments</th> |
| 43 | + </tr> |
| 44 | + </thead> |
| 45 | + <tbody> |
| 46 | + <tr> |
| 47 | + <td>Cloudflare Managed Ruleset</td> |
| 48 | + <td> |
| 49 | + <RuleID id="6fe90532af50427484a5275c8c2e30fb" /> |
| 50 | + </td> |
| 51 | + <td>100717</td> |
| 52 | + <td>SimpleHelp - Auth Bypass - CVE:CVE-2024-57727</td> |
| 53 | + <td>Log</td> |
| 54 | + <td>Block</td> |
| 55 | + <td>This rule is merged to 100717 in legacy WAF and <RuleID id="498fcd81a62a4b5ca943e2de958094d3" /> in new WAF</td> |
| 56 | + </tr> |
| 57 | + <tr> |
| 58 | + <td>Cloudflare Managed Ruleset</td> |
| 59 | + <td> |
| 60 | + <RuleID id="013ef5de3f074fd5a43cdd70d58b886b" /> |
| 61 | + </td> |
| 62 | + <td>100775</td> |
| 63 | + <td>Flowise Cloud - Information Disclosure - CVE:CVE-2025-58434</td> |
| 64 | + <td>Log</td> |
| 65 | + <td>Block</td> |
| 66 | + <td>This is a New Detection</td> |
| 67 | + </tr> |
| 68 | + <tr> |
| 69 | + <td>Cloudflare Managed Ruleset</td> |
| 70 | + <td> |
| 71 | + <RuleID id="68fc5c086ccb4b40a35a63b19bce1ff4" /> |
| 72 | + </td> |
| 73 | + <td>100881</td> |
| 74 | + <td>WordPress:Plugin:Ditty - SSRF - CVE:CVE-2025-8085</td> |
| 75 | + <td>Log</td> |
| 76 | + <td>Block</td> |
| 77 | + <td>This is a New Detection</td> |
| 78 | + </tr> |
| 79 | + <tr> |
| 80 | + <td>Cloudflare Managed Ruleset</td> |
| 81 | + <td> |
| 82 | + <RuleID id="9e1a56e6b3bc49b187bf6e35ddc329dd" /> |
| 83 | + </td> |
| 84 | + <td>100887</td> |
| 85 | + <td>Vite - Directory Traversal - CVE:CVE-2025-30208</td> |
| 86 | + <td>Log</td> |
| 87 | + <td>Block</td> |
| 88 | + <td>This is a New Detection</td> |
| 89 | + </tr> |
| 90 | + </tbody> |
| 91 | +</table> |
0 commit comments