How we mitigated a vulnerability in Cloudflare’s ACME validation logic

What this post added

This post details a vulnerability in Cloudflare's ACME HTTP-01 challenge logic where WAF features were disabled on specific ACME-related paths, allowing requests that should have been blocked to proceed to the origin. The mitigation involved a code change that ensures security features are only disabled when a request matches a valid ACME HTTP-01 challenge token for the hostname, and Cloudflare has a challenge response to serve.