Cloudflare recently addressed a critical vulnerability in its Web Application Firewall (WAF) related to the ACME HTTP-01 validation process. This vulnerability allowed attackers to bypass security protocols and access origin servers through improperly validated ACME challenge tokens. Discovered and reported in October through Cloudflare’s bug bounty program, the flaw stemmed from the system not properly verifying whether the challenge tokens matched active challenges specific to the requested hostnames.
The vulnerability was mainly focused on requests matching the /.well-known/acme-challenge/ path, which led to the disabling of WAF protections without ensuring the token’s validity for the associated hostname. As a result, attackers could potentially navigate around security measures to reach origin servers globally, exposing sensitive information.
Although Cloudflare has found no evidence of this vulnerability being exploited in the wild, security experts have highlighted the risk posed by AI-driven attacks that may target similar bypass vulnerabilities in the future. To mitigate this, Cloudflare updated their validation logic to ensure that WAF features are only disabled for valid and specific ACME challenges, effectively closing this side door in its security infrastructure.
This incident underscores the importance of meticulous security configurations and validates the role of proactive security measures, such as bug bounty programs, in identifying and patching potential vulnerabilities before they can be exploited.

Collections

Cloudflare fixed a critical WAF bypass vulnerability in its ACME HTTP-01 validation process that allowed attackers to circumvent security protections and access origin servers. The flaw, discovered through their bug bounty program in October, occurred because the system disabled WAF protections for /.well-known/acme-challenge/ paths without properly verifying that challenge tokens matched active challenges for specific hostnames. Cloudflare updated their validation logic to ensure WAF features are only disabled for valid ACME challenges, with no evidence of exploitation found in the wild.

Cloudflare Addresses WAF Bypass Vulnerability in ACME Validation