Skip to main content

Security controls bypass or absence - Cloudflare

Need​

Implementation of robust security controls to prevent bypassing of Cloudflare

Context​

  • Usage of Java 8 for developing applications with enhanced features and performance
  • Usage of javax.servlet-api for building Java web applications with servlets

Description​

Non compliant code​

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

public class ServerController {

    public void handleRequest(HttpServletRequest request, HttpServletResponse response) {
        String clientIP = request.getRemoteAddr();
        System.out.println("Client IP: " + clientIP);
        // processing the request
    }
}

In the above code, we have a simple servlet in a backend application that handles HTTP requests. The handleRequest method retrieves the IP address of the client that made the request using request.getRemoteAddr().

The vulnerability here is that there is no check to ensure that the request is coming through Cloudflare. An attacker could potentially bypass Cloudflare by making direct requests to the server's IP address.

This would bypass any security measures put in place by Cloudflare, such as DDoS protection, and expose the server to potential attacks. The attacker could also potentially discover sensitive information about the server that would otherwise be hidden behind Cloudflare.

To fix this vulnerability, the application should implement a security control to check that incoming requests are routed through Cloudflare. This could be done by checking the CF-Connecting-IP header, which Cloudflare includes in requests it forwards. If the CF-Connecting-IP header is not present or does not match the IP address of the request, the request should be rejected.

Steps​

  • Implement proper security controls to prevent direct access to the server IP.
  • Configure Cloudflare to handle all incoming requests and block direct access to the server IP.
  • Ensure that the server only accepts requests through Cloudflare and rejects any direct requests to the server IP.
  • Regularly monitor and review server logs to identify any unauthorized direct access attempts.

Compliant code​

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

public class ServerController {

    private static final String CLOUDFLARE_IP = "your_cloudflare_ip_here";

    public void handleRequest(HttpServletRequest request, HttpServletResponse response) {
        String clientIP = request.getRemoteAddr();
        if (!clientIP.equals(CLOUDFLARE_IP)) {
            System.out.println("Unauthorized access attempt from: " + clientIP);
            response.setStatus(HttpServletResponse.SC_FORBIDDEN);
            return;
        }
        System.out.println("Client IP: " + clientIP);
        // processing the request
    }
}

The updated code now includes a security control to prevent direct access to the server IP. This is achieved by checking the IP address of the incoming request. If the IP address does not match the Cloudflare IP (which should be replaced with your actual Cloudflare IP in the CLOUDFLARE_IP constant), the server responds with a 403 Forbidden status, effectively rejecting the request.

This ensures that the server only accepts requests that come through Cloudflare and blocks any direct requests to the server IP.

In addition, the server logs any unauthorized access attempts, which can be useful for identifying potential security threats. Regular monitoring and review of these server logs is recommended to maintain the security of the server.

Please note that this is a basic implementation and might need to be adjusted based on your specific use case and environment. For example, if you are using Cloudflare's Argo Tunnel, the IP check would be unnecessary as all requests would be coming from localhost.

Also, remember to replace "your_cloudflare_ip_here" with the actual IP address of your Cloudflare service.

References​

Last updated on