3 ms·
This also has interesting implications for website operators who use ip allowlists to ensure they "only" receive incoming traffic from their own CDN account. Fo
by arkadiyt 6y ago
This also has interesting implications for website operators who use ip allowlists to ensure they "only" receive incoming traffic from their own CDN account. For instance:
- if you have corp-domain.com on Cloudflare with http basic auth enabled at the edge, which then proxies to your origin server which has an allowlist of Cloudflare ips, I can make my own account and configure it to point at your origin server, granting me access
- if you depend on the cloudflare WAF to block certain attacks to your origin, I can bypass the WAF by configuring a cloudflare worker in my own account to send traffic to your origin
- etc
- tgsovlerkhgsel 6y agoCloudflare also supports Authenticated Origin Pull, where the request from Cloudflare to the origin server will be authenticated with a client certificate. IIRC the same client cert was used for all customers, so the same method allowed you to bypass WAF/access rules etc. even if the victim had authenticated origin pull enabled, as long as the victim didn't validate the host header (which they would't if they used the default setup from the official setup guide). Cloudflare knew about this for many months, possibly a year or multiple years, and I'm not sure if it's fixed or not. I'm not sure CF allows host-rewriting in this scenario. Edit: At least the authenticated origin pull setup guide is unchanged. Not going to verify the entire chain again.
- EE84M3i 6y agoAllowing only IPs over your vendor of choice has never been secure. You need to additionally ensure the request is hitting your configuration, not someone else's.