Cloudflare Security bypass

[coxhaus]

This is the second time I have seen this posted.

MSN

 

[ColinTaylor]

This is the second time I have seen this posted.

Why not post the original source rather than a reprint by a news aggregator site? I assume the first instance you saw was the Bleeping Computer article. I see that article has been updated with a response from Cloudflare.

Update 10/4 - A Cloudflare spokesperson has sent BleepingComputer the following comment regarding Certitude's report:

In our analysis, we found that the firm's findings would have required a customer to disable certain default security configurations on their Cloudflare account and their origin.
Even in this instance, any such abuse can be prevented through the use of custom certificates to manage the communications between Cloudflare and their origin server (e.g. website), or by utilizing Cloudflare Tunnels to communicate from the origin to Cloudflare.

 

[Justinh]

"Even in this instance, any such abuse can be prevented through the use of ..."

I don't know how to take that. It sounds like they are giving an excuse of 'well, you could do this or that, but only if you know about it, and it may cost extra $$ ... we have bugs but there are ways to work around them'.

 

[ColinTaylor]

"Even in this instance, any such abuse can be prevented through the use of ..."

I don't know how to take that. It sounds like they are giving an excuse of 'well, you could do this or that, but only if you know about it, and it may cost extra $$ ... we have bugs but there are ways to work around them'.

I think the preceding sentence is the important part, "would have required a customer to disable certain default security configurations on their Cloudflare account and their origin". Which sounds to me like "If you're stupid enough to do this then...". But I'm not one of their customers so what do I know.

 

[L&LD]

And no customer would ever do that, correct?

The never ending story...

https://arstechnica.com/security/2023/10/vulnerabilities-in-supermicro-bmcs-could-allow-for-unkillable-server-rootkits/ Not only are BMCs vulnerable (of course), but even 'super admins' don't feel they need to take the precautions they should. Why should you update for security issues? Here's...

www.snbforums.com