Alerts

Cloudflare WAF Zero-Day Allowed Attackers to Bypass Security Controls via ACME Challenge Path

Zero Day Wire

— 2 min read
Cloudflare WAF Zero-Day Allowed Attackers to Bypass Security Controls via ACME Challenge Path

A critical zero-day vulnerability in Cloudflare's Web Application Firewall (WAF) allowed attackers to bypass security controls and directly access protected origin servers.

Security researchers at FearsOff discovered that requests targeting the /.well-known/acme-challenge/ directory could reach origin servers even when WAF rules explicitly blocked all other traffic.

How It Worked

The ACME (Automatic Certificate Management Environment) protocol automates SSL/TLS certificate validation. The HTTP-01 method requires websites to serve a token at /.well-known/acme-challenge/{token} for certificate authorities to verify domain ownership.

When Cloudflare processed ACME challenge requests for its managed certificates, the system disabled WAF features to prevent interference with validation. However, a critical flaw emerged: if the requested token didn't match a Cloudflare-managed certificate order, the request bypassed WAF evaluation entirely and proceeded directly to the customer's origin server.

This logic error transformed a narrow certificate validation exception into a broad security bypass affecting all hosts behind Cloudflare protection.

Attack Vectors Demonstrated

Researchers confirmed multiple exploitation paths:

FrameworkAttackImpact
Spring/TomcatServlet path traversal via ..;/Exposed actuator endpoints, database credentials, API tokens, cloud keys
Next.jsDirect origin accessLeaked operational data from server-side rendering
PHPLocal file inclusionFile system access via malicious path parameters

Account-level WAF rules configured to block requests based on custom headers were completely ignored for ACME path traffic.

Disclosure Timeline

DateEvent
October 9, 2025FearsOff reports via HackerOne
October 13, 2025Cloudflare begins validation
October 14, 2025HackerOne triages issue
October 27, 2025Permanent fix deployed

Remediation

Cloudflare modified the code to disable security features only when requests match valid ACME HTTP-01 challenge tokens for the specific hostname.

No customer action is required. Cloudflare confirmed no evidence of malicious exploitation was found.

Post-fix testing confirmed WAF rules now apply uniformly across all paths, including the previously vulnerable ACME challenge route.

Read more

ClickFix Campaign Compromises Legitimate Sites to Deploy MIMICRAT — A Custom C++ RAT With 22 Post-Exploitation Commands

ClickFix Campaign Compromises Legitimate Sites to Deploy MIMICRAT — A Custom C++ RAT With 22 Post-Exploitation Commands

Elastic Security Labs has disclosed a new ClickFix campaign that leverages compromised legitimate websites as delivery infrastructure to deploy a previously undocumented remote access trojan dubbed MIMICRAT (also tracked as AstarionRAT). The campaign, discovered earlier this month, demonstrates significant operational sophistication — from multi-stage PowerShell chains that bypass Windows security controls

By Zero Day Wire
ShinyHunters Linked to Device Code Vishing Attacks Targeting Microsoft Entra Accounts via OAuth 2.0 Abuse

ShinyHunters Linked to Device Code Vishing Attacks Targeting Microsoft Entra Accounts via OAuth 2.0 Abuse

A new wave of attacks is combining voice phishing (vishing) with OAuth 2.0 device authorization abuse to compromise Microsoft Entra accounts at technology, manufacturing, and financial organizations — bypassing traditional phishing infrastructure entirely. Sources told BleepingComputer they believe the ShinyHunters extortion gang is behind the campaigns, which the threat actors

By Zero Day Wire