Skip to content

Commit ca1384c

Browse files
fb1337fb1337
authored
Release-19-May-2025 (#22556)
* Release-19-May-2025 * waf.yaml date added
1 parent 2fe2640 commit ca1384c

File tree

3 files changed

+155
-22
lines changed

3 files changed

+155
-22
lines changed

‎src/content/docs/waf/change-log/2025-05-19.mdx

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
---
2+
title: "2025-05-19"
3+
type: table
4+
pcx_content_type: release-notes
5+
sidebar:
6+
order: 789
7+
tableOfContents: false
8+
---
9+
10+
import { RuleID } from "~/components";
11+
12+
This week's analysis covers four vulnerabilities, with three rated critical due to their Remote Code Execution (RCE) potential. One targets a high-traffic frontend platform, while another targets a popular content management system. These detections are now part of the Cloudflare Managed Ruleset in _Block_ mode.
13+
14+
**Key Findings**
15+
16+
- Commvault Command Center (CVE-2025-34028) exposes an unauthenticated RCE via insecure command injection paths in the web UI. This is critical due to its use in enterprise backup environments.
17+
- BentoML (CVE-2025-27520) reveals an exploitable vector where serialized payloads in model deployment APIs can lead to arbitrary command execution. This targets modern AI/ML infrastructure.
18+
- Craft CMS (CVE-2024-56145) allows RCE through template injection in unauthenticated endpoints. It poses a significant risk for content-heavy websites with plugin extensions.
19+
- Apache HTTP Server (CVE-2024-38475) discloses sensitive server config data due to misconfigured
20+
`mod_proxy` behavior. While not RCE, this is useful for pre-attack recon.
21+
22+
**Impact**
23+
24+
These newly detected vulnerabilities introduce critical risk across modern web stacks, AI infrastructure, and content platforms: unauthenticated RCEs in Commvault, BentoML, and Craft CMS enable full system compromise with minimal attacker effort.
25+
26+
Apache HTTPD information leak can support targeted reconnaissance, increasing the success rate of follow-up exploits. Organizations using these platforms should prioritize patching and monitor for indicators of exploitation using updated WAF detection rules.
27+
28+
<table style="width: 100%">
29+
<thead>
30+
<tr>
31+
<th>Ruleset</th>
32+
<th>Rule ID</th>
33+
<th>Legacy Rule ID</th>
34+
<th>Description</th>
35+
<th>Previous Action</th>
36+
<th>New Action</th>
37+
<th>Comments</th>
38+
</tr>
39+
</thead>
40+
<tbody>
41+
<tr>
42+
<td>Cloudflare Managed Ruleset</td>
43+
<td>
44+
<RuleID id="5c3559ad62994e5b932d7d0075129820" />
45+
</td>
46+
<td>100745</td>
47+
<td>Apache HTTP Server - Information Disclosure - CVE:CVE-2024-38475</td>
48+
<td>Log</td>
49+
<td>Block</td>
50+
<td>This is a New Detection</td>
51+
</tr>
52+
<tr>
53+
<td>Cloudflare Managed Ruleset</td>
54+
<td>
55+
<RuleID id="28a22a685bba478d99bc904526a517f1" />
56+
</td>
57+
<td>100747</td>
58+
<td>Commvault Command Center - Remote Code Execution - CVE:CVE-2025-34028</td>
59+
<td>Log</td>
60+
<td>Block</td>
61+
<td>This is a New Detection</td>
62+
</tr>
63+
<tr>
64+
<td>Cloudflare Managed Ruleset</td>
65+
<td>
66+
<RuleID id="2e6bb954d0634e368c49d7d1d7619ccb" />
67+
</td>
68+
<td>100749</td>
69+
<td>BentoML - Remote Code Execution - CVE:CVE-2025-27520</td>
70+
<td>Log</td>
71+
<td>Disabled</td>
72+
<td>This is a New Detection</td>
73+
</tr>
74+
<tr>
75+
<td>Cloudflare Managed Ruleset</td>
76+
<td>
77+
<RuleID id="91250eebec894705b62305b2f15bfda4" />
78+
</td>
79+
<td>100753</td>
80+
<td>Craft CMS - Remote Code Execution - CVE:CVE-2024-56145</td>
81+
<td>Log</td>
82+
<td>Block</td>
83+
<td>This is a New Detection</td>
84+
</tr>
85+
</tbody>
86+
</table>

‎src/content/docs/waf/change-log/scheduled-changes.mdx

Lines changed: 64 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -25,58 +25,102 @@ import { RSSButton, RuleID } from "~/components";
2525
</thead>
2626
<tbody>
2727
<tr>
28-
<td>2025-05-13</td>
2928
<td>2025-05-19</td>
29+
<td>2025-05-26</td>
3030
<td>Log</td>
31-
<td>100745</td>
31+
<td>100746</td>
32+
<td>
33+
<RuleID id="6a61a14f44af4232a44e45aad127592a" />
34+
</td>
35+
<td>Vercel - Information Disclosure</td>
36+
<td>This is a New Detection</td>
37+
</tr>
38+
<tr>
39+
<td>2025-05-19</td>
40+
<td>2025-05-26</td>
41+
<td>Log</td>
42+
<td>100754</td>
3243
<td>
33-
<RuleID id="5c3559ad62994e5b932d7d0075129820" />
44+
<RuleID id="bd30b3c43eb44335ab6013c195442495" />
3445
</td>
35-
<td>Apache HTTP Server - Information Disclosure - CVE:CVE-2024-38475</td>
46+
<td>AJ-Report - Remote Code Execution - CVE:CVE-2024-15077</td>
3647
<td>This is a New Detection</td>
3748
</tr>
3849
<tr>
39-
<td>2025-05-13</td>
4050
<td>2025-05-19</td>
51+
<td>2025-05-26</td>
4152
<td>Log</td>
42-
<td>100746</td>
53+
<td>100756</td>
4354
<td>
44-
<RuleID id="6a61a14f44af4232a44e45aad127592a" />
55+
<RuleID id="6a13bd6e5fc94b1d9c97eb87dfee7ae4" />
4556
</td>
46-
<td>Vercel - Information Disclosure</td>
57+
<td>NAKIVO Backup - Remote Code Execution - CVE:CVE-2024-48248</td>
4758
<td>This is a New Detection</td>
4859
</tr>
4960
<tr>
50-
<td>2025-05-13</td>
5161
<td>2025-05-19</td>
62+
<td>2025-05-26</td>
5263
<td>Log</td>
53-
<td>100747</td>
64+
<td>100757</td>
5465
<td>
55-
<RuleID id="28a22a685bba478d99bc904526a517f1" />
66+
<RuleID id="a4af6f2f15c9483fa9eab01d1c52f6d0" />
5667
</td>
57-
<td>Commvault Command Center - Remote Code Execution - CVE:CVE-2025-34028</td>
68+
<td>Ingress-Nginx - Remote Code Execution - CVE:CVE-2025-1098</td>
5869
<td>This is a New Detection</td>
5970
</tr>
6071
<tr>
61-
<td>2025-05-13</td>
6272
<td>2025-05-19</td>
73+
<td>2025-05-26</td>
6374
<td>Log</td>
64-
<td>100749</td>
75+
<td>100759</td>
6576
<td>
66-
<RuleID id="2e6bb954d0634e368c49d7d1d7619ccb" />
77+
<RuleID id="bd30b3c43eb44335ab6013c195442495" />
6778
</td>
68-
<td>BentoML - Remote Code Execution - CVE:CVE-2025-27520</td>
79+
<td>SAP NetWeaver - Dangerous File Upload - CVE:CVE-2025-31324</td>
6980
<td>This is a New Detection</td>
7081
</tr>
7182
<tr>
72-
<td>2025-05-13</td>
7383
<td>2025-05-19</td>
84+
<td>2025-05-26</td>
7485
<td>Log</td>
75-
<td>100753</td>
86+
<td>100760</td>
7687
<td>
77-
<RuleID id="91250eebec894705b62305b2f15bfda4" />
88+
<RuleID id="dab2df4f548349e3926fee845366ccc1" />
7889
</td>
79-
<td>Craft CMS - Remote Code Execution - CVE:CVE-2024-56145</td>
90+
<td>Craft CMS - Remote Code Execution - CVE:CVE-2025-32432</td>
91+
<td>This is a New Detection</td>
92+
</tr>
93+
<tr>
94+
<td>2025-05-19</td>
95+
<td>2025-05-26</td>
96+
<td>Log</td>
97+
<td>100761</td>
98+
<td>
99+
<RuleID id="5eb23f172ed64ee08895e161eb40686b" />
100+
</td>
101+
<td>GitHub Action - Remote Code Execution - CVE:CVE-2025-30066</td>
102+
<td>This is a New Detection</td>
103+
</tr>
104+
<tr>
105+
<td>2025-05-19</td>
106+
<td>2025-05-26</td>
107+
<td>Log</td>
108+
<td>100762</td>
109+
<td>
110+
<RuleID id="827037f2d5f941789efcba6260fc041c" />
111+
</td>
112+
<td>Ivanti EPMM - Auth Bypass - CVE:CVE-2025-4428, CVE:CVE-2025-4427</td>
113+
<td>This is a New Detection</td>
114+
</tr>
115+
<tr>
116+
<td>2025-05-19</td>
117+
<td>2025-05-26</td>
118+
<td>Log</td>
119+
<td>100763</td>
120+
<td>
121+
<RuleID id="ddee6d1c4f364768b324609cebafdfe6" />
122+
</td>
123+
<td>F5 Big IP - Remote Code Execution - CVE:CVE-2025-31644</td>
80124
<td>This is a New Detection</td>
81125
</tr>
82126
</tbody>

‎src/content/release-notes/waf.yaml

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,14 @@ productLink: "/waf/"
55
productArea: Application security
66
productAreaLink: /fundamentals/reference/changelog/security/
77
entries:
8-
- publish_date: "2025-05-13"
9-
scheduled_date: "2025-05-19"
8+
- publish_date: "2025-05-19"
9+
scheduled_date: "2025-05-26"
1010
individual_page: true
1111
scheduled: true
1212
link: "/waf/change-log/scheduled-changes/"
13+
- publish_date: "2025-05-19"
14+
individual_page: true
15+
link: "/waf/change-log/2025-05-19/"
1316
- publish_date: "2025-05-05"
1417
individual_page: true
1518
link: "/waf/change-log/2025-05-05/"

0 commit comments

Comments
 (0)