WAF Vulnerability in Akamai, Cloudflare, and Imperva Affected 40% of Fortune 100 Companies

[Kyaw_Myo_Oo]

Dear all,

A recently discovered security vulnerability dubbed “BreakingWAF” in the configuration of web application firewall (WAF) services has left numerous Fortune 1000 companies vulnerable to cyberattacks, according to Zafran, a leading cybersecurity research team.

The flaw affects some of the most popular WAF providers include Akamai, Cloudflare, Fastly, and Imperva. The flaw makes denial-of-service (DoS) attacks, ransomware, and even full application compromise very likely.

https://cybersecuritynews.com/waf-vulnerability-in-akamai-cloudflare-and-imperva/

[benjikauth]

WAF bypass isn't a newly discovered vulnerability nor are any details presented that identify a vulnerability in the actual vendor platforms mentioned. I read the page where he "discloses" the issue but only found a description of WAF bypass due to unrestricted origins and then found the equivalent of an advertisement describing the features his company offers.

I regret giving him the traffic but wanted to know if there was something new happening. If I missed something, I could be wrong, but it wasn't pointed out as something the vendors need to patch or change. It's the equivalent of saying that an exposed endpoint without any restrictions is a new vulnerability. It is not. It's common knowledge that going to an IP without ACL restriction to only allow WAF traffic is a risk. The only piece that wasn't clearly described is "advanced fingerprinting techniques" but attackers can identify CIDR ranges owned by enterprises and they don't even need DNS names to see if they get responses when scanning those IPs. 

Please point out if there is something that I've missed.