Did Mlytics wait for Cloudflare to patch the vulnerability?

Question

The vulnerability in Nginx on Cloudflare, disclosed on October 25, 2018, by Daniel Fariña of ODS, stemmed from a default limitation in Nginx's Lua module. This module would process a maximum of 100 request arguments, silently discarding any beyond that count. This behavior was intentionally implemented to mitigate potential denial-of-service (DoS) attacks, which could be exacerbated by excessively large or numerous arguments overwhelming the server. Consequently, any Web Application Firewall (WAF) built upon this Nginx configuration would be rendered ineffective if an attacker could exploit this argument-parsing limit. A WAF's primary function is to act as a security layer, inspecting incoming HTTP traffic and blocking malicious requests that might exploit web application vulnerabilities, such as SQL injection or cross-site scripting (XSS). Nginx itself is a high-performance web server, reverse proxy, and load balancer, widely adopted for its efficiency and scalability in handling web traffic.

Accepted Answer

Mlytics, a company that develops its own WAF utilizing Nginx, identified that some of its users, who had integrated Cloudflare through Mlytics' Multi CDN solution, were exposed to this specific vulnerability. A Multi CDN approach aggregates services from multiple Content Delivery Networks (CDNs) to enhance performance, reliability, and resilience. In this context, Mlytics provided its WAF protection across these integrated CDNs. The core issue was that when requests exceeded the 100-argument limit, Cloudflare's WAF, operating on the Nginx layer, would fail to inspect the full request payload, including any potentially malicious parameters. This bypass allowed attackers to send malformed requests with over 100 arguments, effectively circumventing Cloudflare's security measures. The type of attack facilitated by this vulnerability could include attempts at command injection, where an attacker tries to execute arbitrary commands on the server by embedding them within request arguments.

Reading history

Hide →

This history is cleared when the page is closed.

Did Mlytics wait for Cloudflare to patch the vulnerability?

Loading

Was this article helpful?

Helpful

Not helpful

Report an issue

1

0

0

Share with friends