Keeping Drupal sites safe with Cloudflare's WAF

This post details the implementation and effectiveness of a new Cloudflare WAF rule (ID D0003) designed to mitigate the Drupalgeddon 2 vulnerability (CVE-2018-7600). It analyzes the vulnerability's technical details, including the exploitation of renderable arrays and insufficient input validation in Drupal. The post quantifies the WAF's impact by reporting the number of blocked attacks (over 500,000 in a week), the daily unique IP addresses attempting exploitation, and provides examples of malicious payloads, including attempts to download specific files. It also highlights the ongoing nature of the threat, with over 56,000 blocked attacks per day.