InfoSecBulletin Cybersecurity for mankind
A critical zero-day flaw in Cloudflare’s Web Application Firewall (WAF) let attackers evade security measures and access protected servers via a certificate validation path.
Security researchers at FearsOff found that requests to the /.well-known/acme-challenge/ directory bypassed customer-configured WAF rules that blocked other traffic.
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
The Automatic Certificate Management Environment (ACME) protocol automates SSL/TLS certificate validation by requiring Certificate Authorities (CAs) to verify domain ownership.
CAs require websites to serve a one-time token at /.well-known/acme-challenge/{token} for HTTP-01 validation. Most modern websites have this path for automated certificate issuance.
The design intention limits this access to a single validation bot checking one specific file, not as an open gateway to the origin server.
Cloudflare Zero-Day Vulnerability:
FearsOff researchers found the vulnerability while checking apps that restricted access to specific sources. Testing showed that requests to the ACME challenge path evaded WAF rules, enabling direct responses from the origin server rather than Cloudflare’s block page.
To confirm this wasn’t a tenant-specific misconfiguration, researchers created controlled demonstration hosts at cf-php.fearsoff.org, cf-spring.fearsoff.org, and cf-nextjs.fearsoff.org.
Normal requests to these hosts showed block pages, but ACME path requests produced responses from the origin, usually resulting in framework 404 errors.
The vulnerability stemmed from how Cloudflare processed ACME HTTP-01 challenge paths. To avoid disrupting CA validation, Cloudflare turned off WAF features while serving challenge tokens for its managed certificate orders.
However, a critical flaw emerged: if the requested token didn’t match a Cloudflare-managed certificate order, the request bypassed WAF evaluation entirely and proceeded directly to the customer origin.
The logic error turned a specific certificate validation issue into a widespread security vulnerability for all hosts protected by Cloudflare.
The bypass allowed researchers to demonstrate multiple attack vectors against common web frameworks. On Spring/Tomcat applications, servlet path traversal techniques using ..;/ accessed sensitive actuator endpoints that exposed process environments, database credentials, API tokens, and cloud keys.
Next.js server-side rendering apps inadvertently shared operational data through direct responses meant for private access.
PHP apps with local file inclusion flaws are now vulnerable, letting attackers access the file system through harmful path parameters. Additionally, WAF rules meant to block requests with custom headers were bypassed for ACME path traffic.
FearsOff reported a vulnerability via Cloudflare’s HackerOne bug bounty on October 9, 2025. Cloudflare started validation on October 13, 2025, and HackerOne assessed the issue on October 14, 2025.
Cloudflare implemented a permanent fix on October 27, 2025, changing the code to disable security features exclusively for valid ACME HTTP-01 challenge tokens related to the specific hostname.
WAF rules now uniformly apply across all paths, including the previously vulnerable ACME challenge route. Cloudflare confirmed no customer action is needed and found no evidence of malicious exploitation.
