Skip to content

Commit 1fdcd79

Browse files
fb1337pedrosousa
authored and
sdnts
committed
[WAF] Release June 02-2025 (cloudflare#22834)
--------- Co-authored-by: Pedro Sousa <[email protected]>
1 parent 1d25d74 commit 1fdcd79

File tree

3 files changed

+138
-29
lines changed

3 files changed

+138
-29
lines changed

‎src/content/docs/waf/change-log/2025-06-02.mdx‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
---
2+
title: "2025-06-02"
3+
type: table
4+
pcx_content_type: release-notes
5+
sidebar:
6+
order: 787
7+
tableOfContents: false
8+
---
9+
10+
import { RuleID } from "~/components";
11+
12+
This week’s roundup highlights five high-risk vulnerabilities affecting SD-WAN, load balancers, and AI platforms. Several flaws enable unauthenticated remote code execution or authentication bypass.
13+
14+
**Key Findings**
15+
16+
- Versa Concerto SD-WAN (CVE-2025-34026, CVE-2025-34027): Authentication bypass vulnerabilities allow attackers to gain unauthorized access to SD-WAN management interfaces, compromising network segmentation and control.
17+
- Kemp LoadMaster (CVE-2024-7591): Remote Code Execution vulnerability enables attackers to execute arbitrary commands, potentially leading to full device compromise within enterprise load balancing environments.
18+
- AnythingLLM (CVE-2024-0759): Server-Side Request Forgery (SSRF) flaw allows external attackers to force the LLM backend to make unauthorized internal network requests, potentially exposing sensitive internal resources.
19+
- Anyscale Ray (CVE-2023-48022): Remote Code Execution vulnerability affecting distributed AI workloads, allowing attackers to execute arbitrary code on Ray cluster nodes.
20+
- Server-Side Request Forgery (SSRF) - Generic & Obfuscated Payloads: Ongoing advancements in SSRF payload techniques observed, including obfuscation and expanded targeting of cloud metadata services and internal IP ranges.
21+
22+
**Impact**
23+
24+
These vulnerabilities expose critical infrastructure across networking, AI platforms, and SaaS integrations. Unauthenticated RCE and auth bypass flaws in Versa Concerto, Kemp LoadMaster, and Anyscale Ray allow full system compromise. AnythingLLM and SSRF payload variants expand attack surfaces into internal cloud resources, sensitive APIs, and metadata services, increasing risk of privilege escalation, data theft, and persistent access.
25+
26+
<table style="width: 100%">
27+
<thead>
28+
<tr>
29+
<th>Ruleset</th>
30+
<th>Rule ID</th>
31+
<th>Legacy Rule ID</th>
32+
<th>Description</th>
33+
<th>Previous Action</th>
34+
<th>New Action</th>
35+
<th>Comments</th>
36+
</tr>
37+
</thead>
38+
<tbody>
39+
<tr>
40+
<td>Cloudflare Managed Ruleset</td>
41+
<td>
42+
<RuleID id="752cfb5e6f9c46f0953c742139b52f02" />
43+
</td>
44+
<td>100764</td>
45+
<td>Versa Concerto SD-WAN - Auth Bypass - CVE:CVE-2025-34027</td>
46+
<td>Log</td>
47+
<td>Block</td>
48+
<td>This is a New Detection</td>
49+
</tr>
50+
<tr>
51+
<td>Cloudflare Managed Ruleset</td>
52+
<td>
53+
<RuleID id="a01171de18034901b48a5549a34edb97" />
54+
</td>
55+
<td>100765</td>
56+
<td>Versa Concerto SD-WAN - Auth Bypass - CVE:CVE-2025-34026</td>
57+
<td>Log</td>
58+
<td>Block</td>
59+
<td>This is a New Detection</td>
60+
</tr>
61+
<tr>
62+
<td>Cloudflare Managed Ruleset</td>
63+
<td>
64+
<RuleID id="840b35492a7543c18ffe50fc0d99b2db" />
65+
</td>
66+
<td>100766</td>
67+
<td>Kemp LoadMaster - Remote Code Execution - CVE:CVE-2024-7591</td>
68+
<td>Log</td>
69+
<td>Block</td>
70+
<td>This is a New Detection</td>
71+
</tr>
72+
<tr>
73+
<td>Cloudflare Managed Ruleset</td>
74+
<td>
75+
<RuleID id="121b7070de3a459dbe80d7ed95aa3a4f" />
76+
</td>
77+
<td>100767</td>
78+
<td>AnythingLLM - SSRF - CVE:CVE-2024-0759</td>
79+
<td>Log</td>
80+
<td>Block</td>
81+
<td>This is a New Detection</td>
82+
</tr>
83+
<tr>
84+
<td>Cloudflare Managed Ruleset</td>
85+
<td>
86+
<RuleID id="215417f989e2485a9c50eca0840a0966" />
87+
</td>
88+
<td>100768</td>
89+
<td>Anyscale Ray - Remote Code Execution - CVE:CVE-2023-48022</td>
90+
<td>Log</td>
91+
<td>Block</td>
92+
<td>This is a New Detection</td>
93+
</tr>
94+
<tr>
95+
<td>Cloudflare Managed Ruleset</td>
96+
<td>
97+
<RuleID id="3ed619a17d4141bda3a8c3869d16ee18" />
98+
</td>
99+
<td>100781</td>
100+
<td>SSRF - Generic Payloads</td>
101+
<td>N/A</td>
102+
<td>Disabled</td>
103+
<td>This is a New Detection</td>
104+
</tr>
105+
<tr>
106+
<td>Cloudflare Managed Ruleset</td>
107+
<td>
108+
<RuleID id="7ce73f6a70be49f8944737465c963d9d" />
109+
</td>
110+
<td>100782</td>
111+
<td>SSRF - Obfuscated Payloads</td>
112+
<td>N/A</td>
113+
<td>Disabled</td>
114+
<td>This is a New Detection</td>
115+
</tr>
116+
</tbody>
117+
</table>

‎src/content/docs/waf/change-log/scheduled-changes.mdx‎

Lines changed: 16 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -25,58 +25,47 @@ import { RSSButton, RuleID } from "~/components";
2525
</thead>
2626
<tbody>
2727
<tr>
28-
<td>2025-05-27</td>
2928
<td>2025-06-02</td>
29+
<td>2025-06-09</td>
3030
<td>Log</td>
31-
<td>100764</td>
31+
<td>100769</td>
3232
<td>
33-
<RuleID id="752cfb5e6f9c46f0953c742139b52f02" />
33+
<RuleID id="4afd50a3ef1948bba87c4e620debd86e" />
3434
</td>
35-
<td>Versa Concerto SD-WAN - Auth Bypass - CVE:CVE-2025-34027</td>
35+
<td>WordPress OttoKit Plugin - Privilege Escalation - CVE:CVE-2025-27007</td>
3636
<td>This is a New Detection</td>
3737
</tr>
3838
<tr>
39-
<td>2025-05-27</td>
4039
<td>2025-06-02</td>
40+
<td>2025-06-09</td>
4141
<td>Log</td>
42-
<td>100765</td>
42+
<td>100770</td>
4343
<td>
44-
<RuleID id="a01171de18034901b48a5549a34edb97" />
44+
<RuleID id="24134c41c3e940daa973b4b95f57b448" />
4545
</td>
46-
<td>Versa Concerto SD-WAN - Auth Bypass - CVE:CVE-2025-34026</td>
46+
<td>SAP NetWeaver - Remote Code Execution - CVE:CVE-2025-42999</td>
4747
<td>This is a New Detection</td>
4848
</tr>
4949
<tr>
50-
<td>2025-05-27</td>
5150
<td>2025-06-02</td>
51+
<td>2025-06-09</td>
5252
<td>Log</td>
53-
<td>100766</td>
53+
<td>100779</td>
5454
<td>
55-
<RuleID id="840b35492a7543c18ffe50fc0d99b2db" />
55+
<RuleID id="4f219ac0be3545a5be5f0bf34df8857a" />
5656
</td>
57-
<td>Kemp LoadMaster - Remote Code Execution - CVE:CVE-2024-7591</td>
57+
<td>Fortinet FortiVoice - Buffer Error - CVE:CVE-2025-32756</td>
5858
<td>This is a New Detection</td>
5959
</tr>
6060
<tr>
61-
<td>2025-05-27</td>
6261
<td>2025-06-02</td>
62+
<td>2025-06-09</td>
6363
<td>Log</td>
64-
<td>100767</td>
64+
<td>100780</td>
6565
<td>
66-
<RuleID id="121b7070de3a459dbe80d7ed95aa3a4f" />
66+
<RuleID id="bc8dfbe8cbac4c039725ec743b840107" />
6767
</td>
68-
<td>AnythingLLM - SSRF - CVE:CVE-2024-0759</td>
69-
<td>This is a New Detection</td>
70-
</tr>
71-
<tr>
72-
<td>2025-05-27</td>
73-
<td>2025-06-02</td>
74-
<td>Log</td>
75-
<td>100768</td>
76-
<td>
77-
<RuleID id="215417f989e2485a9c50eca0840a0966" />
78-
</td>
79-
<td>Anyscale Ray - Remote Code Execution - CVE:CVE-2023-48022</td>
68+
<td>Camaleon CMS - Remote Code Execution - CVE:CVE-2024-46986</td>
8069
<td>This is a New Detection</td>
8170
</tr>
8271
</tbody>

‎src/content/release-notes/waf.yaml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,14 @@ productLink: "/waf/"
55
productArea: Application security
66
productAreaLink: /fundamentals/reference/changelog/security/
77
entries:
8-
- publish_date: "2025-05-27"
9-
scheduled_date: "2025-06-02"
8+
- publish_date: "2025-06-02"
9+
scheduled_date: "2025-06-09"
1010
individual_page: true
1111
scheduled: true
1212
link: "/waf/change-log/scheduled-changes/"
13+
- publish_date: "2025-06-02"
14+
individual_page: true
15+
link: "/waf/change-log/2025-06-02/"
1316
- publish_date: "2025-05-27"
1417
individual_page: true
1518
link: "/waf/change-log/2025-05-27/"

0 commit comments

Comments
 (0)