Incorrect proxying of 24 hostnames on January 24, 2022
Jan 26, 2022Jeremy Hartman
Summary
This post details an incident where a product migration for Cloudflare for SaaS resulted in 24 hostnames, including www.cloudflare.com, being incorrectly proxied to the wrong origin (clickfunnels.com). It highlights a critical failure in the migration process for 'blocked' hostnames, leading to unintended traffic redirection. The post outlines the immediate remediation steps, the scale of the impact, and crucial procedural and technical follow-ups to prevent recurrence, such as stricter validation for blocked hostnames and enhanced monitoring during migrations.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack