https://developers.cloudflare.com/waf/change-log/Updates to Cloudflare's WAF product.en-usMonday, Mar 4, 2024https://developers.cloudflare.com/waf/change-log/scheduled-changes/ <table style="width: 100%"> <thead> <tr> <th>Announcement Date</th> <th>Release Date</th> <th>Release Behavior</th> <th>Legacy Rule ID</th> <th>Rule ID</th> <th>Description</th> <th>Comments</th> </tr> </thead> <tbody> <tr> <td>2024-03-04</td> <td>2024-03-11</td> <td>Block</td> <td>100627</td> <td>...dc6877e2</td> <td>Wordpress:Plugin:Bricks Builder Theme - Command Injection - CVE:CVE-2024-25600</td> <td>N/A</td> </tr> <tr> <td>2024-03-04</td> <td>2024-03-11</td> <td>Block</td> <td>100628</td> <td>...ae685218</td> <td>ConnectWise - Auth Bypass</td> <td>N/A</td> </tr> </tbody> </table>Monday, Mar 4, 2024https://developers.cloudflare.com/waf/change-log/2024-03-04/ <table style="width: 100%"> <thead> <tr> <th>Ruleset</th> <th>Rule ID</th> <th>Legacy Rule ID</th> <th>Description</th> <th>Previous Action</th> <th>New Action</th> <th>Comments</th> </tr> </thead> <tbody> <tr> <td>Cloudflare Specials</td> <td>...aa290ad9</td> <td>100135D</td> <td>XSS - JS On Events</td> <td>N/A</td> <td>Block</td> <td>This detection was released as ...9c1c14e6 (BETA) in new WAF</td> </tr> </tbody> </table>Monday, Mar 4, 2024https://developers.cloudflare.com/waf/change-log/2024-02-26/ <table style="width: 100%"> <thead> <tr> <th>Ruleset</th> <th>Rule ID</th> <th>Legacy Rule ID</th> <th>Description</th> <th>Previous Action</th> <th>New Action</th> <th>Comments</th> </tr> </thead> <tbody> <tr> <td>Cloudflare Specials</td> <td>...1d870399</td> <td>100546</td> <td>XSS - HTML Encoding</td> <td>N/A</td> <td>Block</td> <td>This detection was released as ...07c62aeb (BETA) in new WAF</td> </tr> </tbody> </table>Monday, Feb 26, 2024https://developers.cloudflare.com/waf/change-log/2024-02-20/ <table style="width: 100%"> <thead> <tr> <th>Ruleset</th> <th>Rule ID</th> <th>Legacy Rule ID</th> <th>Description</th> <th>Previous Action</th> <th>New Action</th> <th>Comments</th> </tr> </thead> <tbody> <tr> <td>Cloudflare Specials</td> <td>...9a5581d0</td> <td>100622B, 100622C</td> <td>Ivanti - Command Injection - CVE:CVE-2023-46805, CVE:CVE-2024-21887, CVE:CVE-2024-22024</td> <td>N/A</td> <td>Block</td> <td>N/A</td> </tr> <tr> <td>Cloudflare Specials</td> <td>...d0b325aa</td> <td>N/A</td> <td>Microsoft ASP.NET - Code Injection - Function response.write</td> <td>N/A</td> <td>Block</td> <td>This detection was released as ...50c86f85 (BETA) in new WAF</td> </tr> <tr> <td>Cloudflare Specials</td> <td>...1b138b3e</td> <td>N/A</td> <td>NoSQL, MongoDB - SQLi - Comparison</td> <td>N/A</td> <td>Block</td> <td>This detection was released as ...4ba436bb (BETA) in new WAF</td> </tr> <tr> <td>Cloudflare Specials</td> <td>...8f66903c</td> <td>N/A</td> <td>NoSQL, MongoDB - SQLi - Expression</td> <td>N/A</td> <td>Block</td> <td>This detection was released as ...f67956b2 (BETA) in new WAF</td> </tr> <tr> <td>Cloudflare Specials</td> <td>...2d2e031c</td> <td>N/A</td> <td>PHP - Code Injection</td> <td>N/A</td> <td>Disabled</td> <td>This detection was released as ...2a1f3a04 (BETA) in new WAF</td> </tr> <tr> <td>Cloudflare Specials</td> <td>...824b817c</td> <td>N/A</td> <td>PHP, vBulletin, jQuery File Upload - Code Injection, Dangerous File Upload - CVE:CVE-2018-9206, CVE:CVE-2019-17132</td> <td>N/A</td> <td>Block</td> <td>This detection was released as ...dcd12482 (BETA) in new WAF</td> </tr> </tbody> </table>Tuesday, Feb 20, 2024https://developers.cloudflare.com/waf/change-log/2024-02-12/ <table style="width: 100%"> <thead> <tr> <th>Ruleset</th> <th>Rule ID</th> <th>Legacy Rule ID</th> <th>Description</th> <th>Previous Action</th> <th>New Action</th> <th>Comments</th> </tr> </thead> <tbody> <tr> <td>Cloudflare Specials</td> <td>...901523c0</td> <td>100625</td> <td>Jenkins - Information Disclosure - CVE:CVE-2024-23897</td> <td>N/A</td> <td>Block</td> <td>N/A</td> </tr> <tr> <td>Cloudflare Specials</td> <td>...d5e015dd</td> <td>100514</td> <td>Log4j Headers</td> <td>N/A</td> <td>Block</td> <td>N/A</td> </tr> <tr> <td>Cloudflare Specials</td> <td>...dc29b753</td> <td>100515B</td> <td>Log4j Body Obfuscation</td> <td>N/A</td> <td>Block</td> <td>N/A</td> </tr> </tbody> </table>Monday, Feb 12, 2024https://developers.cloudflare.com/waf/change-log/2024-02-05/ <table style="width: 100%"> <thead> <tr> <th>Ruleset</th> <th>Rule ID</th> <th>Legacy Rule ID</th> <th>Description</th> <th>Previous Action</th> <th>New Action</th> <th>Comments</th> </tr> </thead> <tbody> <tr> <td>Cloudflare Specials</td> <td>...52d6027b</td> <td>100624</td> <td>GoAnywhere - Auth Bypass - CVE:CVE-2024-0204</td> <td>N/A</td> <td>Block</td> <td>N/A</td> </tr> <tr> <td>Cloudflare Specials</td> <td>...f89ab164</td> <td>100626,100626A</td> <td>Anomaly:Header:Content-Type - Multiple</td> <td>N/A</td> <td>Disabled</td> <td>New Detection</td> </tr> <tr> <td>Cloudflare Specials</td> <td>...7736c63c</td> <td>N/A</td> <td>AngularJS - XSS</td> <td>N/A</td> <td>Block</td> <td>This detection was released as ...014fc5b9 (BETA) in new WAF</td> </tr> <tr> <td>Cloudflare Specials</td> <td>...a02344cb</td> <td>N/A</td> <td>Apache HTTP Server - Server-Side Includes</td> <td>N/A</td> <td>Disabled</td> <td>This detection was released as ...10cae4a8 (BETA) in new WAF</td> </tr> <tr> <td>Cloudflare Specials</td> <td>...af52d528</td> <td>N/A</td> <td>Command Injection - CVE:CVE-2014-6271</td> <td>N/A</td> <td>Block</td> <td>This detection was released as ...d2a0991c (BETA) in new WAF</td> </tr> <tr> <td>Cloudflare Specials</td> <td>...b090ba9a</td> <td>N/A</td> <td>Command Injection - Nslookup</td> <td>N/A</td> <td>Block</td> <td>This detection was released as ...da3d944c (BETA) in new WAF</td> </tr> <tr> <td>Cloudflare Specials</td> <td>...d5a14a5e</td> <td>N/A</td> <td>Microsoft ASP.NET - Code Injection</td> <td>N/A</td> <td>Disabled</td> <td>This detection was released as ...70f4f073 (BETA) in new WAF</td> </tr> </tbody> </table>Monday, Feb 5, 2024https://developers.cloudflare.com/waf/change-log/2024-01-22---emergency-release/ <table style="width: 100%"> <thead> <tr> <th>Ruleset</th> <th>Rule ID</th> <th>Legacy Rule ID</th> <th>Description</th> <th>Previous Action</th> <th>New Action</th> <th>Comments</th> </tr> </thead> <tbody> <tr> <td>Cloudflare Specials</td> <td>...da07a922</td> <td>100623</td> <td>Atlassian Confluence - Template Injection - CVE:CVE-2023-22527</td> <td>N/A</td> <td>Block</td> <td>N/A</td> </tr> </tbody> </table>Monday, Jan 22, 2024https://developers.cloudflare.com/waf/change-log/2024-01-17---emergency-release/ <table style="width: 100%"> <thead> <tr> <th>Ruleset</th> <th>Rule ID</th> <th>Legacy Rule ID</th> <th>Description</th> <th>Previous Action</th> <th>New Action</th> <th>Comments</th> </tr> </thead> <tbody> <tr> <td>Cloudflare Specials</td> <td>...34ab53c5</td> <td>100622</td> <td>Ivanti - Auth Bypass, Command Injection - CVE:CVE-2023-46805, CVE:CVE-2024-21887</td> <td>N/A</td> <td>Block</td> <td>N/A</td> </tr> </tbody> </table>Wednesday, Jan 17, 2024https://developers.cloudflare.com/waf/change-log/2024-01-16/ <table style="width: 100%"> <thead> <tr> <th>Ruleset</th> <th>Rule ID</th> <th>Legacy Rule ID</th> <th>Description</th> <th>Previous Action</th> <th>New Action</th> <th>Comments</th> </tr> </thead> <tbody> <tr> <td>Cloudflare Specials</td> <td>...38906cff</td> <td>100620</td> <td>Microsoft ASP.NET - Remote Code Execution - CVE:CVE-2023-35813</td> <td>N/A</td> <td>Block</td> <td>N/A</td> </tr> <tr> <td>Cloudflare Specials</td> <td>...84f664a9</td> <td>100619</td> <td>Liferay - Remote Code Execution - CVE:CVE-2020-7961</td> <td>N/A</td> <td>Block</td> <td>N/A</td> </tr> <tr> <td>Cloudflare Specials</td> <td>...7d29ec39</td> <td>100618</td> <td>pfSense - Remote Code Execution - CVE:CVE-2023-42326</td> <td>N/A</td> <td>Block</td> <td>N/A</td> </tr> <tr> <td>Cloudflare Specials</td> <td>...9016ef33</td> <td>100621</td> <td>Clerk - Auth Bypass</td> <td>N/A</td> <td>Disabled</td> <td>N/A</td> </tr> </tbody> </table>Tuesday, Jan 16, 2024https://developers.cloudflare.com/waf/change-log/2024-01-04/ <table style="width: 100%"> <thead> <tr> <th>Ruleset</th> <th>Rule ID</th> <th>Legacy Rule ID</th> <th>Description</th> <th>Previous Action</th> <th>New Action</th> <th>Comments</th> </tr> </thead> <tbody> <tr> <td>Cloudflare Specials</td> <td>...53c7ccde</td> <td>100612</td> <td>SnakeYAML - CVE:CVE-2022-1471</td> <td>N/A</td> <td>Block</td> <td>N/A</td> </tr> </tbody> </table>Thursday, Jan 4, 2024https://developers.cloudflare.com/waf/change-log/2023-12-18/ <table style="width: 100%"> <thead> <tr> <th>Ruleset</th> <th>Rule ID</th> <th>Legacy Rule ID</th> <th>Description</th> <th>Previous Action</th> <th>New Action</th> <th>Comments</th> </tr> </thead> <tbody> <tr> <td>Cloudflare Specials</td> <td>...1bc977d1</td> <td>N/A</td> <td>DotNetNuke - File Inclusion - CVE:CVE-2018-9126, CVE:CVE-2011-1892, CVE:CVE-2022-31474</td> <td>N/A</td> <td>Block</td> <td>This rule was released as ...76abfd64</td> </tr> </tbody> </table>Monday, Dec 18, 2023https://developers.cloudflare.com/waf/change-log/2023-12-14---emergency-release/ <table style="width: 100%"> <thead> <tr> <th>Ruleset</th> <th>Rule ID</th> <th>Legacy Rule ID</th> <th>Description</th> <th>Previous Action</th> <th>New Action</th> <th>Comments</th> </tr> </thead> <tbody> <tr> <td>Cloudflare Specials</td> <td>...bb6d4e13</td> <td>100615</td> <td>Apache Struts - Remote Code Execution - CVE:CVE-2023-50164</td> <td>N/A</td> <td>Block</td> <td>N/A</td> </tr> </tbody> </table>Thursday, Dec 14, 2023https://developers.cloudflare.com/waf/change-log/2023-11-21/ <table style="width: 100%"> <thead> <tr> <th>Ruleset</th> <th>Rule ID</th> <th>Legacy Rule ID</th> <th>Description</th> <th>Previous Action</th> <th>New Action</th> <th>Comments</th> </tr> </thead> <tbody> <tr> <td>Cloudflare Specials</td> <td>...8ed2b1d9</td> <td>100611</td> <td>WordPress:Plugin:WooCommerce - Unauthorized Administrator Access - CVE:CVE-2023-28121</td> <td>N/A</td> <td>Block</td> <td>N/A</td> </tr> <tr> <td>Cloudflare Specials</td> <td>...c3b6a372</td> <td>100593</td> <td>Adobe ColdFusion - Auth Bypass, Remote Code Execution - CVE:CVE-2023-29298, CVE:CVE-2023-38203, CVE:CVE-2023-26360</td> <td>N/A</td> <td>Block</td> <td>N/A</td> </tr> </tbody> </table>Tuesday, Nov 21, 2023https://developers.cloudflare.com/waf/change-log/2023-11-06---emergency-release/ <table style="width: 100%"> <thead> <tr> <th>Ruleset</th> <th>Rule ID</th> <th>Legacy Rule ID</th> <th>Description</th> <th>Previous Action</th> <th>New Action</th> <th>Comments</th> </tr> </thead> <tbody> <tr> <td>Cloudflare Specials</td> <td>...c54e7046</td> <td>100614</td> <td>Atlassian Confluence - Code Injection - CVE:CVE-2023-22518</td> <td>N/A</td> <td>Block</td> <td>N/A</td> </tr> </tbody> </table>Monday, Nov 6, 2023https://developers.cloudflare.com/waf/change-log/2023-10-30/ <table style="width: 100%"> <thead> <tr> <th>Ruleset</th> <th>Rule ID</th> <th>Legacy Rule ID</th> <th>Description</th> <th>Previous Action</th> <th>New Action</th> <th>Comments</th> </tr> </thead> <tbody> <tr> <td>Cloudflare Specials</td> <td>...d59a59db</td> <td>100609</td> <td>Keycloak - SSRF - CVE:CVE-2020-10770</td> <td>N/A</td> <td>Block</td> <td>N/A</td> </tr> </tbody> </table>Monday, Oct 30, 2023https://developers.cloudflare.com/waf/change-log/2023-10-23/ <table style="width: 100%"> <thead> <tr> <th>Ruleset</th> <th>Rule ID</th> <th>Legacy Rule ID</th> <th>Description</th> <th>Previous Action</th> <th>New Action</th> <th>Comments</th> </tr> </thead> <tbody> <tr> <td>Cloudflare Specials</td> <td>...3e3f706d</td> <td>100606</td> <td>JetBrains TeamCity - Auth Bypass, Remote Code Execution - CVE:CVE-2023-42793</td> <td>N/A</td> <td>Block</td> <td>N/A</td> </tr> <tr> <td>Cloudflare Specials</td> <td>...469c4a38</td> <td>100607</td> <td>Progress WS_FTP - Information Disclosure - CVE:CVE-2023-40044</td> <td>N/A</td> <td>Block</td> <td>N/A</td> </tr> <tr> <td>Cloudflare Specials</td> <td>...7ccccdce</td> <td>100608</td> <td>Progress WS_FTP - Remote Code Execution - CVE:CVE-2023-40044</td> <td>N/A</td> <td>Block</td> <td>N/A</td> </tr> </tbody> </table>Monday, Oct 23, 2023https://developers.cloudflare.com/waf/change-log/2023-10-11---emergency-release/ <table style="width: 100%"> <thead> <tr> <th>Ruleset</th> <th>Rule ID</th> <th>Legacy Rule ID</th> <th>Description</th> <th>Previous Action</th> <th>New Action</th> <th>Comments</th> </tr> </thead> <tbody> <tr> <td>Cloudflare Specials</td> <td>...ec9f34e1</td> <td>100604</td> <td>Atlassian Confluence - Privilege Escalation - CVE:CVE-2023-22515</td> <td>N/A</td> <td>Block</td> <td>This rule is released for our Cloudflare Free customers as well, rule ID: ...91935fcb (Detection logic update)</td> </tr> </tbody> </table>Wednesday, Oct 11, 2023https://developers.cloudflare.com/waf/change-log/2023-10-04---emergency-release/ <table style="width: 100%"> <thead> <tr> <th>Ruleset</th> <th>Rule ID</th> <th>Legacy Rule ID</th> <th>Description</th> <th>Previous Action</th> <th>New Action</th> <th>Comments</th> </tr> </thead> <tbody> <tr> <td>Cloudflare Specials</td> <td>...ec9f34e1</td> <td>100604,100605</td> <td>Atlassian Confluence - Privilege Escalation - CVE:CVE-2023-22515</td> <td>N/A</td> <td>Block</td> <td>This rule is released for our Cloudflare Free customers as well, rule ID: ...91935fcb</td> </tr> </tbody> </table>Tuesday, Oct 3, 2023https://developers.cloudflare.com/waf/change-log/2023-10-02/ <table style="width: 100%"> <thead> <tr> <th>Ruleset</th> <th>Rule ID</th> <th>Legacy Rule ID</th> <th>Description</th> <th>Previous Action</th> <th>New Action</th> <th>Comments</th> </tr> </thead> <tbody> <tr> <td>Cloudflare Specials</td> <td>...34780914</td> <td>100532</td> <td>Vulnerability scanner activity</td> <td>N/A</td> <td>Block</td> <td>This rule was released as 100532_BETA in legacy waf and ...6e298ed7 in new WAF</td> </tr> </tbody> </table>Monday, Oct 2, 2023https://developers.cloudflare.com/waf/change-log/2023-09-22---emergency-release/ <table style="width: 100%"> <thead> <tr> <th>Ruleset</th> <th>Rule ID</th> <th>Legacy Rule ID</th> <th>Description</th> <th>Previous Action</th> <th>New Action</th> <th>Comments</th> </tr> </thead> <tbody> <tr> <td>Cloudflare Specials</td> <td>...066c0c9a</td> <td>100602</td> <td>Code Injection - CVE:CVE-2023-36845</td> <td>N/A</td> <td>Block</td> <td>N/A</td> </tr> <tr> <td>Cloudflare Specials</td> <td>...0746d000</td> <td>100603</td> <td>Information Disclosure - CVE:CVE-2023-28432</td> <td>N/A</td> <td>Block</td> <td>N/A</td> </tr> </tbody> </table>Friday, Sep 22, 2023https://developers.cloudflare.com/waf/change-log/2023-09-18/ <table style="width: 100%"> <thead> <tr> <th>Ruleset</th> <th>Rule ID</th> <th>Legacy Rule ID</th> <th>Description</th> <th>Previous Action</th> <th>New Action</th> <th>Comments</th> </tr> </thead> <tbody> <tr> <td>Cloudflare Specials</td> <td>...25ba9d7c</td> <td>N/A</td> <td>SSRF Cloud</td> <td>N/A</td> <td>Disabled</td> <td>N/A</td> </tr> </tbody> </table>Monday, Sep 18, 2023https://developers.cloudflare.com/waf/change-log/2023-09-04/ <table style="width: 100%"> <thead> <tr> <th>Ruleset</th> <th>Rule ID</th> <th>Legacy Rule ID</th> <th>Description</th> <th>Previous Action</th> <th>New Action</th> <th>Comments</th> </tr> </thead> <tbody> <tr> <td>Cloudflare Specials</td> <td>...c5f041ac</td> <td>100597</td> <td>Information Disclosure - Path Normalization</td> <td>Log</td> <td>Block</td> <td>N/A</td> </tr> <tr> <td>Cloudflare Specials</td> <td>...50cec478</td> <td>100598</td> <td>Remote Code Execution - Common Bash Bypass</td> <td>Log</td> <td>Block</td> <td>N/A</td> </tr> <tr> <td>Cloudflare Specials</td> <td>...ec5b0d04</td> <td>100599</td> <td>Ivanti - Auth Bypass - CVE:CVE-2023-38035</td> <td>Log</td> <td>Block</td> <td>N/A</td> </tr> <tr> <td>Cloudflare Specials</td> <td>...6912c055</td> <td>100601</td> <td>Malware - Polymorphic Encoder</td> <td>Log</td> <td>Block</td> <td>N/A</td> </tr> <tr> <td>Cloudflare Specials</td> <td>...8242627b</td> <td>100146B</td> <td>SSRF Local BETA</td> <td>Log</td> <td>Disabled</td> <td>N/A</td> </tr> </tbody> </table>Monday, Sep 4, 2023https://developers.cloudflare.com/waf/change-log/2023-08-21/ <table style="width: 100%"> <thead> <tr> <th>Ruleset</th> <th>Rule ID</th> <th>Legacy Rule ID</th> <th>Description</th> <th>Previous Action</th> <th>New Action</th> <th>Comments</th> </tr> </thead> <tbody> <tr> <td>Cloudflare Specials</td> <td>...84dadf5a</td> <td>100595</td> <td>MobileIron - Auth Bypass - CVE:CVE-2023-35082</td> <td>Log</td> <td>Block</td> <td>N/A</td> </tr> <tr> <td>Cloudflare Specials</td> <td>...48a60154</td> <td>N/A</td> <td>SQLi - Keyword + SubExpress + Comment + BETA</td> <td>N/A</td> <td>Disabled</td> <td>N/A</td> </tr> </tbody> </table>Monday, Aug 21, 2023https://developers.cloudflare.com/waf/change-log/2023-08-17---emergency-release/ <table style="width: 100%"> <thead> <tr> <th>Ruleset</th> <th>Rule ID</th> <th>Legacy Rule ID</th> <th>Description</th> <th>Previous Action</th> <th>New Action</th> <th>Comments</th> </tr> </thead> <tbody> <tr> <td>Cloudflare Specials</td> <td>...cac42ce2</td> <td>100596</td> <td>Citrix Content Collaboration ShareFile - Remote Code Execution - CVE:CVE-2023-24489</td> <td>N/A</td> <td>Block</td> <td>N/A</td> </tr> </tbody> </table>Thursday, Aug 17, 2023