Cloudflare whacks WAF bypass bug that opened side door for attackers

Cloudflare has fixed a flaw in its web application firewall (WAF) that allowed attackers to bypass security rules and directly access origin servers, which could lead to data theft or full server takeover. FearsOff security researchers reported the bug in October through Cloudflare's bug bounty program, and the CDN says it has patched the vulnerability in its ACME (Automatic Certificate Management Environment) validation logic with no action required from its customers. ACME is a protocol that certificate authorities and services like Cloudflare use to automate the issuance, renewal, and revocation of SSL/TLS certificates. It uses challenges to prove domain ownership before issuing a security certificate, and this is typically done via an HTTP-01 challenge that checks for a validation token at the HTTP path following this format: http://{customer domain}/.well-known/acme-challenge/{token value}. In its report, the cyber-threat hunting firm likens a WAF to the front door and ACME to a hallway that should only be used by a certificate robot to verify domain ownership. When configured correctly, a WAF can help let expected validation traffic through while filtering out many malicious requests, including automated bots. "A certificate robot's hallway should never become a side door," the FearsOff researchers wrote. The "side door" in this case was caused by a logic flaw in how Cloudflare processed some ACME challenge requests. "Previously, when Cloudflare was serving a HTTP-01 ch...