WAF: New SSRF and SSTI threat detections
The WAF now includes new detections for Server-Side Request Forgery attacks using non-standard IP notations and jar loopback payloads, plus defenses against Server-Side Template Injection targeting Jinja environments.
This release introduces new threat detections to enhance protection against Server-Side Request Forgery (SSRF) attempts using non-standard IP notations or jar loopback payloads, alongside new defenses against Server-Side Template Injection (SSTI) targeting Jinja environments.
| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | ...5f21b651 | N/A | SSRF - Cloud,Link-Local non-standard IP notation | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...0f0313d6 | N/A | SSRF - Block jar HTTP loopback payload | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...75cd912a | N/A | SSRF - Local non-standard IP notation | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...a1ba83f6 | N/A | SSTI - Jinja Dangerous Globals Chain | Log | Block | This is a new detection. |
Source: original entry ↗
More from Cloudflare
Follow Cloudflare to get its new changes in your feed and email digest.
Cloudflare One Client for Windows hotfix - trusted certificate chains
A new GA release for Windows Cloudflare One Client is available, addressing an issue with building trusted certificate chains.
Cloudflare One Client for macOS - Trusted Certificate Chain Fix
A new GA release of the macOS Cloudflare One Client is available. This hotfix addresses an issue with building trusted certificate chains.
Cloudflare One Client for Linux
A new GA release of Cloudflare One Client for Linux is now available. This hotfix addresses an issue with building trusted certificate chains.