2) Let's say our target is http://grafana.fearsoff.net, which has this firewall rule: (http://http.host eq "http://grafana.fearsoff.net" and ip.src ne 1.1.1.1)

3) This means that if anyone tries to access https://grafana.fearsoff.net without using the internal VPN with IP 1.1.1.1, they will get an Access denied message.

4) We discover that http://grafana.fearsoff.net points to IP address 13.214.193.141 on AWS. But this IP is not directly accessible because the AWS security group only allows Cloudflare IP ranges.

5) Here's where it gets interesting. To access that Grafana application without the internal VPN (1.1.1.1), all we need to do is: Create a DNS A record in a Cloudflare zone we control and point it to 13.214.193.141.

6) Now, when we access the domain we control (in this case https://bypass-grafana.fearsof... we bypass the Cloudflare Firewall policy. In fact we are reaching the AWS server through Cloudflare's IPs.

7) Even scarier: if multiple servers share the same Cloudflare-only SG, you can point records to them too. - Misconfigured apps/proxy (nginx, apache, kong, k8s) - Services trusting x-forwarded-host Lots of attack surface.

8) Important: This is not a Cloudflare product vulnerability. This is a misconfiguration vulnerability at the origin.

9) If you want a pentest from an elite team of ethical hackers, feel free to reach out @FearsOff. Happy bug hunting! https://fearsoff.org/research/...

@k_firsov @FearsOff Props for this awesome research 👏 I remember back then Cloudflare Workers IPs were also within the range, so it was possible to bypass that way too, but they closed that path later. Thanks for sharing your knowledge 🙏🔥

@AtaTurk1925 @FearsOff Well, actually they still are using this range https://www.cloudflare.com/ips... ;)

@k_firsov @FearsOff Neat trick if the origin is misconfigured….. to allow ANY cloudflare IP …… and you also know where the origin is lol

@AndrewMohawk @FearsOff Who said bugbounty is easy? :)

@k_firsov @FearsOff @grok summarize and give me steps

@k_firsov @FearsOff I wrote two writeups about cloudflare: The first one about bypassing WAF rules if it only allows cloudflare ips only https://0vulns.medium.com/rip-... The second one about finding the origin server behind cloudflare using cookies name https://0vulns.medium.com/a-de...

@k_firsov @FearsOff Interesting 🤔... Thanks for sharing

@k_firsov @FearsOff @Aaronvern11 noot noot