4 ms·

I have a question which might be stupid. What happens for sites using Full SSL (a certificate between cloudflare and the user and a certificate between cloudfl

by sersi 10y ago

I have a question which might be stupid. What happens for sites using Full SSL (a certificate between cloudflare and the user and a certificate between cloudflare and the server), could any information from ssl pages have been leaked?

AlexandrB 10y ago
My understanding is yes - if the https page was in CF memory (for decrypting from server and encrypting for user) its contents could have been dumped to a cache of one of the affected sites.
- omegaworks 10y ago
  To be even more clear: if the CF servers had any plaintext in memory, that plaintext might have been compromised. Plaintext could be anything from HTML pages to GET and POST request data (containing auth keys, passwords, JSON blobs, etc.) If CF decrypts information you send to it before encrypting it to your users, that's a step where plaintext might have been present in their servers' memory. (Please correct me if I'm wrong.)
- fiedzia 10y ago
  According to CF, they store certificates and cached content separately, so they were not exposed.
  - oldsj 10y ago
    Right. Clear text data was exposed, not the certificate itself. But who needs a certificate when you have the cleartext?
chrisper 10y ago
Full SSL just means there is SSL between your server and cloudflare. CF still terminates the user ssl at their point.
- artursapek 10y ago
  Hence the joke that they are MITMing half the internet... or perhaps it's not a joke :)
deleted 10y ago
[deleted]
manigandham 10y ago
Yes. Encrypted traffic is unique to every TLS session so when data is received from the origin, it must be decrypted (then stored and cached by the server) and then re-encrypted for every user that CF sends the data to. This is the whole reason why all CDNs are a MITM for secure connections. In this case, certain CF features when enabled would transform the HTML that was sent to users, and sometimes it would include random bits of the server's memory in the output. These bits of memory could include anything like private data from other requests and responses being handled by the server. This is very similar to the openssl heartbleed issue which also exposed random bits of the server's memory under certain conditions.

by sersi 10y ago

AlexandrB 10y ago

My understanding is yes - if the https page was in CF memory (for decrypting from server and encrypting for user) its contents could have been dumped to a cache of one of the affected sites.

omegaworks 10y ago
To be even more clear: if the CF servers had any plaintext in memory, that plaintext might have been compromised. Plaintext could be anything from HTML pages to GET and POST request data (containing auth keys, passwords, JSON blobs, etc.) If CF decrypts information you send to it before encrypting it to your users, that's a step where plaintext might have been present in their servers' memory. (Please correct me if I'm wrong.)
fiedzia 10y ago
According to CF, they store certificates and cached content separately, so they were not exposed.
- oldsj 10y ago
  Right. Clear text data was exposed, not the certificate itself. But who needs a certificate when you have the cleartext?

chrisper 10y ago

Full SSL just means there is SSL between your server and cloudflare. CF still terminates the user ssl at their point.

artursapek 10y ago
Hence the joke that they are MITMing half the internet... or perhaps it's not a joke :)

deleted 10y ago

[deleted]

manigandham 10y ago

Yes. Encrypted traffic is unique to every TLS session so when data is received from the origin, it must be decrypted (then stored and cached by the server) and then re-encrypted for every user that CF sends the data to. This is the whole reason why all CDNs are a MITM for secure connections. In this case, certain CF features when enabled would transform the HTML that was sent to users, and sometimes it would include random bits of the server's memory in the output. These bits of memory could include anything like private data from other requests and responses being handled by the server. This is very similar to the openssl heartbleed issue which also exposed random bits of the server's memory under certain conditions.