Skip to content

Commit 31bb8a9

Browse files
vs-mgsdnts
vs-mg
authored and
sdnts
committed
Release-May-27-2025 (cloudflare#22702)
1 parent 04f7d0c commit 31bb8a9

File tree

3 files changed

+177
-73
lines changed

3 files changed

+177
-73
lines changed

‎src/content/docs/waf/change-log/2025-05-27.mdx‎

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
---
2+
title: "2025-05-27"
3+
type: table
4+
pcx_content_type: release-notes
5+
sidebar:
6+
order: 788
7+
tableOfContents: false
8+
---
9+
10+
import { RuleID } from "~/components";
11+
12+
This week’s roundup covers nine vulnerabilities, including six critical RCEs and one dangerous file upload. Affected platforms span cloud services, CI/CD pipelines, CMSs, and enterprise backup systems. Several are now addressed by updated WAF managed rulesets.
13+
14+
**Key Findings**
15+
16+
- Ingress-Nginx (CVE-2025-1098): Unauthenticated RCE via unsafe annotation handling. Impacts Kubernetes clusters.
17+
- GitHub Actions (CVE-2025-30066): RCE through malicious workflow inputs. Targets CI/CD pipelines.
18+
- Craft CMS (CVE-2025-32432): Template injection enables unauthenticated RCE. High risk to content-heavy sites.
19+
- F5 BIG-IP (CVE-2025-31644): RCE via TMUI exploit, allowing full system compromise.
20+
- AJ-Report (CVE-2024-15077): RCE through untrusted template execution. Affects reporting dashboards.
21+
- NAKIVO Backup (CVE-2024-48248): RCE via insecure script injection. High-value target for ransomware.
22+
- SAP NetWeaver (CVE-2025-31324): Dangerous file upload flaw enables remote shell deployment.
23+
- Ivanti EPMM (CVE-2025-4428, 4427): Auth bypass allows full access to mobile device management.
24+
- Vercel (CVE-2025-32421): Information leak via misconfigured APIs. Useful for attacker recon.
25+
26+
**Impact**
27+
28+
These newly detected vulnerabilities introduce critical risk across modern web stacks, AI infrastructure, and content platforms: unauthenticated RCEs in Commvault, BentoML, and Craft CMS enable full system compromise with minimal attacker effort.
29+
30+
Apache HTTPD information leak can support targeted reconnaissance, increasing the success rate of follow-up exploits. Organizations using these platforms should prioritize patching and monitor for indicators of exploitation using updated WAF detection rules.
31+
32+
<table style="width: 100%">
33+
<thead>
34+
<tr>
35+
<th>Ruleset</th>
36+
<th>Rule ID</th>
37+
<th>Legacy Rule ID</th>
38+
<th>Description</th>
39+
<th>Previous Action</th>
40+
<th>New Action</th>
41+
<th>Comments</th>
42+
</tr>
43+
</thead>
44+
<tbody>
45+
<tr>
46+
<td>Cloudflare Managed Ruleset</td>
47+
<td>
48+
<RuleID id="6a61a14f44af4232a44e45aad127592a" />
49+
</td>
50+
<td>100746</td>
51+
<td>Vercel - Information Disclosure</td>
52+
<td>Log</td>
53+
<td>Disabled</td>
54+
<td>This is a New Detection</td>
55+
</tr>
56+
<tr>
57+
<td>Cloudflare Managed Ruleset</td>
58+
<td>
59+
<RuleID id="bd30b3c43eb44335ab6013c195442495" />
60+
</td>
61+
<td>100754</td>
62+
<td>AJ-Report - Remote Code Execution - CVE:CVE-2024-15077</td>
63+
<td>Log</td>
64+
<td>Block</td>
65+
<td>This is a New Detection</td>
66+
</tr>
67+
<tr>
68+
<td>Cloudflare Managed Ruleset</td>
69+
<td>
70+
<RuleID id="6a13bd6e5fc94b1d9c97eb87dfee7ae4" />
71+
</td>
72+
<td>100756</td>
73+
<td>NAKIVO Backup - Remote Code Execution - CVE:CVE-2024-48248</td>
74+
<td>Log</td>
75+
<td>Block</td>
76+
<td>This is a New Detection</td>
77+
</tr>
78+
<tr>
79+
<td>Cloudflare Managed Ruleset</td>
80+
<td>
81+
<RuleID id="a4af6f2f15c9483fa9eab01d1c52f6d0" />
82+
</td>
83+
<td>100757</td>
84+
<td>Ingress-Nginx - Remote Code Execution - CVE:CVE-2025-1098</td>
85+
<td>Log</td>
86+
<td>Disabled</td>
87+
<td>This is a New Detection</td>
88+
</tr>
89+
<tr>
90+
<td>Cloudflare Managed Ruleset</td>
91+
<td>
92+
<RuleID id="bd30b3c43eb44335ab6013c195442495" />
93+
</td>
94+
<td>100759</td>
95+
<td>SAP NetWeaver - Dangerous File Upload - CVE:CVE-2025-31324</td>
96+
<td>Log</td>
97+
<td>Block</td>
98+
<td>This is a New Detection</td>
99+
</tr>
100+
<tr>
101+
<td>Cloudflare Managed Ruleset</td>
102+
<td>
103+
<RuleID id="dab2df4f548349e3926fee845366ccc1" />
104+
</td>
105+
<td>100760</td>
106+
<td>Craft CMS - Remote Code Execution - CVE:CVE-2025-32432</td>
107+
<td>Log</td>
108+
<td>Block</td>
109+
<td>This is a New Detection</td>
110+
</tr>
111+
<tr>
112+
<td>Cloudflare Managed Ruleset</td>
113+
<td>
114+
<RuleID id="5eb23f172ed64ee08895e161eb40686b" />
115+
</td>
116+
<td>100761</td>
117+
<td>GitHub Action - Remote Code Execution - CVE:CVE-2025-30066</td>
118+
<td>Log</td>
119+
<td>Disabled</td>
120+
<td>This is a New Detection</td>
121+
</tr>
122+
<tr>
123+
<td>Cloudflare Managed Ruleset</td>
124+
<td>
125+
<RuleID id="827037f2d5f941789efcba6260fc041c" />
126+
</td>
127+
<td>100762</td>
128+
<td>Ivanti EPMM - Auth Bypass - CVE:CVE-2025-4428, CVE:CVE-2025-4427</td>
129+
<td>Log</td>
130+
<td>Block</td>
131+
<td>This is a New Detection</td>
132+
</tr>
133+
<tr>
134+
<td>Cloudflare Managed Ruleset</td>
135+
<td>
136+
<RuleID id="ddee6d1c4f364768b324609cebafdfe6" />
137+
</td>
138+
<td>100763</td>
139+
<td>F5 Big IP - Remote Code Execution - CVE:CVE-2025-31644</td>
140+
<td>Log</td>
141+
<td>Disabled</td>
142+
<td>This is a New Detection</td>
143+
</tr>
144+
</tbody>
145+
</table>

‎src/content/docs/waf/change-log/scheduled-changes.mdx‎

Lines changed: 27 additions & 71 deletions
Original file line numberDiff line numberDiff line change
@@ -25,102 +25,58 @@ import { RSSButton, RuleID } from "~/components";
2525
</thead>
2626
<tbody>
2727
<tr>
28-
<td>2025-05-19</td>
29-
<td>2025-05-26</td>
28+
<td>2025-05-27</td>
29+
<td>2025-06-02</td>
3030
<td>Log</td>
31-
<td>100746</td>
31+
<td>100764</td>
3232
<td>
33-
<RuleID id="6a61a14f44af4232a44e45aad127592a" />
33+
<RuleID id="752cfb5e6f9c46f0953c742139b52f02" />
3434
</td>
35-
<td>Vercel - Information Disclosure</td>
35+
<td>Versa Concerto SD-WAN - Auth Bypass - CVE:CVE-2025-34027</td>
3636
<td>This is a New Detection</td>
3737
</tr>
3838
<tr>
39-
<td>2025-05-19</td>
40-
<td>2025-05-26</td>
39+
<td>2025-05-27</td>
40+
<td>2025-06-02</td>
4141
<td>Log</td>
42-
<td>100754</td>
43-
<td>
44-
<RuleID id="bd30b3c43eb44335ab6013c195442495" />
45-
</td>
46-
<td>AJ-Report - Remote Code Execution - CVE:CVE-2024-15077</td>
47-
<td>This is a New Detection</td>
48-
</tr>
49-
<tr>
50-
<td>2025-05-19</td>
51-
<td>2025-05-26</td>
52-
<td>Log</td>
53-
<td>100756</td>
54-
<td>
55-
<RuleID id="6a13bd6e5fc94b1d9c97eb87dfee7ae4" />
56-
</td>
57-
<td>NAKIVO Backup - Remote Code Execution - CVE:CVE-2024-48248</td>
58-
<td>This is a New Detection</td>
59-
</tr>
60-
<tr>
61-
<td>2025-05-19</td>
62-
<td>2025-05-26</td>
63-
<td>Log</td>
64-
<td>100757</td>
65-
<td>
66-
<RuleID id="a4af6f2f15c9483fa9eab01d1c52f6d0" />
67-
</td>
68-
<td>Ingress-Nginx - Remote Code Execution - CVE:CVE-2025-1098</td>
69-
<td>This is a New Detection</td>
70-
</tr>
71-
<tr>
72-
<td>2025-05-19</td>
73-
<td>2025-05-26</td>
74-
<td>Log</td>
75-
<td>100759</td>
76-
<td>
77-
<RuleID id="bd30b3c43eb44335ab6013c195442495" />
78-
</td>
79-
<td>SAP NetWeaver - Dangerous File Upload - CVE:CVE-2025-31324</td>
80-
<td>This is a New Detection</td>
81-
</tr>
82-
<tr>
83-
<td>2025-05-19</td>
84-
<td>2025-05-26</td>
85-
<td>Log</td>
86-
<td>100760</td>
87-
<td>
88-
<RuleID id="dab2df4f548349e3926fee845366ccc1" />
89-
</td>
90-
<td>Craft CMS - Remote Code Execution - CVE:CVE-2025-32432</td>
42+
<td>100765</td>
43+
<td>
44+
<RuleID id="a01171de18034901b48a5549a34edb97" />
45+
</td>
46+
<td>Versa Concerto SD-WAN - Auth Bypass - CVE:CVE-2025-34026</td>
9147
<td>This is a New Detection</td>
9248
</tr>
9349
<tr>
94-
<td>2025-05-19</td>
95-
<td>2025-05-26</td>
50+
<td>2025-05-27</td>
51+
<td>2025-06-02</td>
9652
<td>Log</td>
97-
<td>100761</td>
53+
<td>100766</td>
9854
<td>
99-
<RuleID id="5eb23f172ed64ee08895e161eb40686b" />
55+
<RuleID id="840b35492a7543c18ffe50fc0d99b2db" />
10056
</td>
101-
<td>GitHub Action - Remote Code Execution - CVE:CVE-2025-30066</td>
57+
<td>Kemp LoadMaster - Remote Code Execution - CVE:CVE-2024-7591</td>
10258
<td>This is a New Detection</td>
10359
</tr>
10460
<tr>
105-
<td>2025-05-19</td>
106-
<td>2025-05-26</td>
61+
<td>2025-05-27</td>
62+
<td>2025-06-02</td>
10763
<td>Log</td>
108-
<td>100762</td>
64+
<td>100767</td>
10965
<td>
110-
<RuleID id="827037f2d5f941789efcba6260fc041c" />
66+
<RuleID id="121b7070de3a459dbe80d7ed95aa3a4f" />
11167
</td>
112-
<td>Ivanti EPMM - Auth Bypass - CVE:CVE-2025-4428, CVE:CVE-2025-4427</td>
68+
<td>AnythingLLM - SSRF - CVE:CVE-2024-0759</td>
11369
<td>This is a New Detection</td>
11470
</tr>
11571
<tr>
116-
<td>2025-05-19</td>
117-
<td>2025-05-26</td>
72+
<td>2025-05-27</td>
73+
<td>2025-06-02</td>
11874
<td>Log</td>
119-
<td>100763</td>
75+
<td>100768</td>
12076
<td>
121-
<RuleID id="ddee6d1c4f364768b324609cebafdfe6" />
77+
<RuleID id="215417f989e2485a9c50eca0840a0966" />
12278
</td>
123-
<td>F5 Big IP - Remote Code Execution - CVE:CVE-2025-31644</td>
79+
<td>Anyscale Ray - Remote Code Execution - CVE:CVE-2023-48022</td>
12480
<td>This is a New Detection</td>
12581
</tr>
12682
</tbody>

‎src/content/release-notes/waf.yaml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,14 @@ productLink: "/waf/"
55
productArea: Application security
66
productAreaLink: /fundamentals/reference/changelog/security/
77
entries:
8-
- publish_date: "2025-05-19"
9-
scheduled_date: "2025-05-26"
8+
- publish_date: "2025-05-27"
9+
scheduled_date: "2025-06-02"
1010
individual_page: true
1111
scheduled: true
1212
link: "/waf/change-log/scheduled-changes/"
13+
- publish_date: "2025-05-27"
14+
individual_page: true
15+
link: "/waf/change-log/2025-05-27/"
1316
- publish_date: "2025-05-19"
1417
individual_page: true
1518
link: "/waf/change-log/2025-05-19/"

0 commit comments

Comments
 (0)