The Cloudflare Bug Bounty program and Cloudflare Pages
May 6, 2022Evan Johnson, Natalie Rogers
Summary
This post details six security vulnerabilities discovered in Cloudflare Pages' CI/CD build pipeline and publishing process by security researchers. It describes command injection flaws in `CLONE_REPO` and `PUBLISH_ASSETS`, API key disclosure due to incorrect file permissions, bash path injection, an Azure pipelines escape via the docker socket, and a Kubernetes API access issue due to a missing iptables rule. The post outlines the remediation steps taken, including input validation fixes, secret rotation, permission adjustments, architectural changes (adopting gVisor, migrating to Kubernetes), and customer notifications. It highlights the importance of the bug bounty program in identifying and fixing these issues.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack