How Cloudflare’s AI WAF proactively detected the Ivanti Connect Secure critical zero-day vulnerability
Jan 23, 2024Himanshu Anand, Radwa Radwan, Vaibhav Singhal
Summary
This post details how Cloudflare's AI-powered WAF Attack Score and Emergency Rules proactively detected and mitigated the Ivanti Connect Secure zero-day vulnerabilities (CVE-2023-46805 and CVE-2024-21887). It provides a technical analysis of the exploit techniques, including directory traversal and command injection via Python reverse shells, and explains how the WAF Attack Score (specifically the RCE score) identified these malicious requests. The post also highlights the rapid deployment of Emergency Rules to block these specific threats, demonstrating the effectiveness of Cloudflare's AI-driven security approach in protecting customers against undisclosed vulnerabilities.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack