InfoSecBulletin Cybersecurity for mankind
Cloudflare, despite its strong DDoS protection, can still be bypassed by exploiting logic flaws in its firewall demanded by Security researcher Stefan Proksch from Certitude. This allows attackers to perform DDoS attacks on targeted devices.
Cloudflare DDoS Protection Bypass Discovered:
Samsung phone is saving your passwords in plain text
UK Software Firm Exposed 8 million of Healthcare Worker Records
GitHub Enterprise Server Vulns Expose Risk of Code Execution
CVE-2025-2492
ASUS warns of critical auth bypass flaw in routers
16,000+ Fortinet devices compromised with symlink backdoor, Mostly in Asia
Patch now! Critical Erlang/OTP SSH Vuln Allows UCE
CISA warns of increasing risk tied to Oracle legacy Cloud leak
CVE-2025-20236
Cisco Patches Unauthenticated RCE Flaw in Webex App
Apple released emergency security updates for 2 zero-day vulns
Oracle Released Patched for 378 flaws for April 2025
Security researcher Stefan Proksch from Certitude recently discussed how an attacker can bypass Cloudflare’s DDoS protections by exploiting the service.
The researcher found two vulnerabilities in Cloudflare’s firewall and DDoS protection. The problems are related to how the service works, specifically with Cloudflare’s “Authenticated Origin Pulls” and “Allowlist Cloudflare IP Addresses.”
These mechanisms protect a server from harmful traffic by trusting HTTPS requests from Cloudflare. The service then verifies the traffic using an SSL/TLS certificate that customers can generate easily.
The researcher said that even though it seems reliable, allowing any Cloudflare traffic to be trusted could let someone use their own Cloudflare account to attack a particular server.The attacker only needs to know the IP address of the victim server to carry out the DDoS attack.
The researcher shared technical details and a proof of concept in his post. (Click here to see)
Official Patch Yet To Arrive:
Upon discovering the matter, the researcher responsible disclosed the vulnerability to Cloudflare via its HackerOne bug bounty program. However, after Cloudflare simply considered the report “informative,” the researcher decided on public disclosure. While the service hasn’t released an official patch to address the flaws yet, the researcher has suggested mitigations for the users.
Proksch suggests creating customized certificates using the “Authenticated Origin Pulls” feature instead of relying on Cloudflare certificates to prevent unauthorized requests. Additionally, he recommends using the “Allowlist Cloudflare IP addresses” feature as an additional layer of security, rather than relying on it as the only method of server protection.
Source:
certitude.consulting blog post
Bleeping computer
gb hacker
