CloudflareNick DownieAnnouncement
Cloudflare has expanded its web application firewall with full transaction detection and response rules, correlating each HTTP request with its response to identify evidence of successful exploitation. This approach answers both whether a request looks malicious and what happened when the application handled it, using new fields like cf.waf.signature.response.confidence. For example, a path traversal attempt followed by a response containing configuration file content provides stronger evidence of data exposure than either signal alone. Response rules can block the origin’s response before it reaches the requester, preventing sensitive information from reaching an attacker. The feature is generally available to all Cloudflare customers, including Free plans, with managed protections for high-profile vulnerabilities such as php2shell. Detection and mitigation are separated, allowing security teams to inspect detections in Security Analytics before designing policies.
Cloudflare WAF previously only inspected HTTP requests to block attacks. This left a gap: a suspicious request followed by a response exposing sensitive data is different from the same request followed by an error. The new full transaction detection correlates request and response to confirm exploitation, and response rules block the origin response before it reaches the requester.
Cloudflare added new detection fields (cf.waf.signature.response.confidence, categories, ref) that are populated by analyzing the response alongside the request. Response custom rules can then use these fields to block matching responses. Managed protections are provided for high-profile vulnerabilities like php2shell. Detection and mitigation are separated: detections are visible in Security Analytics, and rules can be configured independently.
Full transaction detection correlates request and response to confirm successful exploitation, reducing false positives compared to request-only inspection.
Response rules can block the origin’s response before it reaches the requester, preventing data exposure from exploits like path traversal.
The feature is available to all Cloudflare customers including Free plans, with managed protections for high-profile vulnerabilities.
Full transaction detection correlates the request with the response to confirm whether an exploit succeeded, using response content as evidence. Request-only inspection can only flag suspicious inputs, but cannot tell if the exploit actually worked or exposed data.
The php2shell vulnerability is a flaw in a common software component that puts applications across the Internet at risk. Cloudflare's first managed protections using full transaction detection address this vulnerability.
Yes, paying customers can use detection fields like cf.waf.signature.response.confidence in custom response rules to block responses based on request and response properties. Free plan customers get managed protections for high-profile vulnerabilities.
Summaries are generated from the original by a language model. Check the original before relying on it.
See the idea
A layered architecture for a car-seat ride service: eligibility gates, seat hardware, driver installation training, and caregiver verification. See where checks catch problems before a child rides.
Keep reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
One useful email. Unsubscribe anytime.
