HTTP Request Smuggling in Transform Rules using hexadecimal escape sequences in the concat() function

Summary

The Edge Rules engine used by Cloudflare Transform Rules features string modifying functions like lower() and concat(), which accepted hexadecimal-encoded characters such as ”\x0a\x0d“. This allowed for manipulation of request headers (e.g. injecting an additional header) and, as a consequence, made HTTP smuggling attack (TE.CL) possible. This vulnerability enabled an attacker to bypass security products such as Cloudflare Access and view the content of internal origin servers. This bug in hexadecimal parsing was fixed by the relevant engineering team. We rewarded this finding as critical as well as a bonus for a high quality, detailed report. Internal investigation confirmed that no other CF customer was affected by this attack. As a recommendation, we advise Cloudflare Access customers to always verify the Authorization JWT token before processing requests from the Cloudflare edge.

Cloudflare's Ruleset Engine allows the use of hexadecimal escape sequences in string manipulation functions such as concat(). Due to a lack of output sanitation, this enabled an attacker to inject newlines into the header value. By creating a dynamic header rewrite rule with the value concat("-", "\x0d\x0aTransfer-Encoding: chunked"), it was possible to change the transfer encoding of the request. When combined with a POST body such as 0\r\n\r\nGET / HTTP/1.1\r\nHost: internal.example.com\r\n\r\n it made HTTP request smuggling extremely trivial. Additionally, the position of Transform Rules in the request flow meant it was possible to use internal headers to control many aspects of the request. A fix was rolled out within hours of the report being submitted. I would like to thank the teams at Cloudflare for their efforts.