InfoSecBulletin Cybersecurity for mankind
A critical zero-day flaw in Cloudflare’s Web Application Firewall (WAF) let attackers evade security measures and access protected servers via a certificate validation path.
Security researchers at FearsOff found that requests to the /.well-known/acme-challenge/ directory bypassed customer-configured WAF rules that blocked other traffic.
LastPass says hackers stole customer data via Klue, supply chain breach
New Apple Exploit Bypasses Boot Defenses, Possibly Affects Millions of iPhones Worldwide
India’s Tata Electronics hit by cyber breach: Hacker target 630 GB record
Anthropic’s Mythos reportedly broke NSA classified systems in hours
OpenAI New Method “Deployment Simulation” Predicts AI Risks Before Deployment
AryStinger botnet infected thousands of D-Link routers globally
Hacker suspected of sending alerts across Brazil
CyberSentinel AI features 33 security tools like Nmap, SQLMap, and ZAP, utilizing Claude and GPT
Barracuda hosts Dhaka roundtable on cyber resilience
CISA Alerts Fortinet Users as FortiBleed Affects 86,644 FortiGate Devices
The Automatic Certificate Management Environment (ACME) protocol automates SSL/TLS certificate validation by requiring Certificate Authorities (CAs) to verify domain ownership.
CAs require websites to serve a one-time token at /.well-known/acme-challenge/{token} for HTTP-01 validation. Most modern websites have this path for automated certificate issuance.
The design intention limits this access to a single validation bot checking one specific file, not as an open gateway to the origin server.
Cloudflare Zero-Day Vulnerability:
FearsOff researchers found the vulnerability while checking apps that restricted access to specific sources. Testing showed that requests to the ACME challenge path evaded WAF rules, enabling direct responses from the origin server rather than Cloudflare’s block page.
To confirm this wasn’t a tenant-specific misconfiguration, researchers created controlled demonstration hosts at cf-php.fearsoff.org, cf-spring.fearsoff.org, and cf-nextjs.fearsoff.org.
Normal requests to these hosts showed block pages, but ACME path requests produced responses from the origin, usually resulting in framework 404 errors.
The vulnerability stemmed from how Cloudflare processed ACME HTTP-01 challenge paths. To avoid disrupting CA validation, Cloudflare turned off WAF features while serving challenge tokens for its managed certificate orders.
However, a critical flaw emerged: if the requested token didn’t match a Cloudflare-managed certificate order, the request bypassed WAF evaluation entirely and proceeded directly to the customer origin.
The logic error turned a specific certificate validation issue into a widespread security vulnerability for all hosts protected by Cloudflare.
The bypass allowed researchers to demonstrate multiple attack vectors against common web frameworks. On Spring/Tomcat applications, servlet path traversal techniques using ..;/ accessed sensitive actuator endpoints that exposed process environments, database credentials, API tokens, and cloud keys.
Next.js server-side rendering apps inadvertently shared operational data through direct responses meant for private access.
PHP apps with local file inclusion flaws are now vulnerable, letting attackers access the file system through harmful path parameters. Additionally, WAF rules meant to block requests with custom headers were bypassed for ACME path traffic.
FearsOff reported a vulnerability via Cloudflare’s HackerOne bug bounty on October 9, 2025. Cloudflare started validation on October 13, 2025, and HackerOne assessed the issue on October 14, 2025.
Cloudflare implemented a permanent fix on October 27, 2025, changing the code to disable security features exclusively for valid ACME HTTP-01 challenge tokens related to the specific hostname.
WAF rules now uniformly apply across all paths, including the previously vulnerable ACME challenge route. Cloudflare confirmed no customer action is needed and found no evidence of malicious exploitation.
