Cloudflare DDoS protections bypassed using Cloudflare flaw [PoC]

[Ink]

Content source

https://www.bleepingcomputer.com/news/security/cloudflare-ddos-protections-ironically-bypassed-using-cloudflare/

Cloudflare vs Cloudflare

Cloudflare's Firewall and DDoS prevention can be bypassed through a specific attack process that leverages logic flaws in cross-tenant security controls. To make matters worse, the only requirement for the attack is for the hackers to create a free Cloudflare account, which is used as part of the attack.

[...]

Researchers Florian Schweitzer and Stefan Proksch, who discovered the logic flaws, reported it to Cloudflare via HackerOne on March 16, 2023, but the issue was closed as "informative."

BleepingComputer has contacted Cloudflare to ask if there are any plans to implement additional protection mechanisms or warn clients with potentially risky configurations, but we have yet to hear back.

 

[Numeriku]

This flaw is only worrying if your server IP is leaked, if you secure your website properly with good coding and emails hosted elsewhere, the bypass won't work, most people are using Cloudflare for the proxy/hiding your server IP, if your server IP is leaked what would be the point of using Cloudflare.

 

[SumTingWong]

This flaw is only worrying if your server IP is leaked, if you secure your website properly with good coding and emails hosted elsewhere, the bypass won't work, most people are using Cloudflare for the proxy/hiding your server IP, if your server IP is leaked what would be the point of using Cloudflare.

What about public cloudflare 1.1.1.1 dns?

 

[Vasudev]

My TPLink router has been acting up for few weeks when I add 1.1.1.1 and now it accepted 1.0.0.2. Should I revert to some other DNS?

 

[Numeriku]

What about public cloudflare 1.1.1.1 dns?

Not affected, this is related to authenticated origin pulls and the way Cloudflare handles accounts, if an attacker knows your origin IP, it can act as your origin to bypass the protection that Cloudflare offers.