Today, after the Cloudflare outage, I noticed that almost all upload routes for my applications were being blocked.
After some investigation, I realized that none of these routes passed through Cloudflare OWASP. The reported anomalies total 50, exceeding the pre-configured maximum of 40 (Medium).
Despite being simple image or video uploads, the WAF is generating anomalies that make no sense, such as the following:
Cloudflare OWASP Core Ruleset Score (+5)
933100: PHP Injection Attack: PHP Open Tag Found
Cloudflare OWASP Core Ruleset Score (+5)
933180: PHP Injection Attack: Variable Function Call Found
For now, I’ve had to raise the OWASP Anomaly Score Threshold to 60 and enable the JS Challenge, but I believe something is wrong with the WAF after today’s outage.
A simple, FREE, personal solution for creating and customizing surveys directly in your browser. There is no need for an account or backend storage. Gather valuable insights effortlessly and securely. Connect surveys to Google Sheets or custom backend.
Two years ago I made https://vemto.app, a GUI code generation tool for PHP/Laravel developers. At the time, my wife and I were going through a difficult process, in which we urgently needed to move out of an apartment. The tool sold well enough for us to put a down payment on a house, and has continued to sell for those two years, and now I'm working on a second, more powerful version that not only generates code, but can connect to existing projects to edit them. There is a video of the second version at this link: https://twitter.com/Tiago_Ferat/status/1591450807433826304
After some investigation, I realized that none of these routes passed through Cloudflare OWASP. The reported anomalies total 50, exceeding the pre-configured maximum of 40 (Medium).
Despite being simple image or video uploads, the WAF is generating anomalies that make no sense, such as the following:
Cloudflare OWASP Core Ruleset Score (+5)
933100: PHP Injection Attack: PHP Open Tag Found
Cloudflare OWASP Core Ruleset Score (+5)
933180: PHP Injection Attack: Variable Function Call Found
For now, I’ve had to raise the OWASP Anomaly Score Threshold to 60 and enable the JS Challenge, but I believe something is wrong with the WAF after today’s outage.
This issue was still not solved to this moment.