InfoSecBulletin Cybersecurity for mankind
A critical zero-day flaw in Cloudflare’s Web Application Firewall (WAF) let attackers evade security measures and access protected servers via a certificate validation path.
Security researchers at FearsOff found that requests to the /.well-known/acme-challenge/ directory bypassed customer-configured WAF rules that blocked other traffic.
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
The Automatic Certificate Management Environment (ACME) protocol automates SSL/TLS certificate validation by requiring Certificate Authorities (CAs) to verify domain ownership.
CAs require websites to serve a one-time token at /.well-known/acme-challenge/{token} for HTTP-01 validation. Most modern websites have this path for automated certificate issuance.
The design intention limits this access to a single validation bot checking one specific file, not as an open gateway to the origin server.
Cloudflare Zero-Day Vulnerability:
FearsOff researchers found the vulnerability while checking apps that restricted access to specific sources. Testing showed that requests to the ACME challenge path evaded WAF rules, enabling direct responses from the origin server rather than Cloudflare’s block page.
To confirm this wasn’t a tenant-specific misconfiguration, researchers created controlled demonstration hosts at cf-php.fearsoff.org, cf-spring.fearsoff.org, and cf-nextjs.fearsoff.org.
Normal requests to these hosts showed block pages, but ACME path requests produced responses from the origin, usually resulting in framework 404 errors.
The vulnerability stemmed from how Cloudflare processed ACME HTTP-01 challenge paths. To avoid disrupting CA validation, Cloudflare turned off WAF features while serving challenge tokens for its managed certificate orders.
However, a critical flaw emerged: if the requested token didn’t match a Cloudflare-managed certificate order, the request bypassed WAF evaluation entirely and proceeded directly to the customer origin.
The logic error turned a specific certificate validation issue into a widespread security vulnerability for all hosts protected by Cloudflare.
The bypass allowed researchers to demonstrate multiple attack vectors against common web frameworks. On Spring/Tomcat applications, servlet path traversal techniques using ..;/ accessed sensitive actuator endpoints that exposed process environments, database credentials, API tokens, and cloud keys.
Next.js server-side rendering apps inadvertently shared operational data through direct responses meant for private access.
PHP apps with local file inclusion flaws are now vulnerable, letting attackers access the file system through harmful path parameters. Additionally, WAF rules meant to block requests with custom headers were bypassed for ACME path traffic.
FearsOff reported a vulnerability via Cloudflare’s HackerOne bug bounty on October 9, 2025. Cloudflare started validation on October 13, 2025, and HackerOne assessed the issue on October 14, 2025.
Cloudflare implemented a permanent fix on October 27, 2025, changing the code to disable security features exclusively for valid ACME HTTP-01 challenge tokens related to the specific hostname.
WAF rules now uniformly apply across all paths, including the previously vulnerable ACME challenge route. Cloudflare confirmed no customer action is needed and found no evidence of malicious exploitation.
