Cloudflare Public Bug Bounty

Cloudflare Public Bug Bounty 的公开漏洞报告、类别分布与常见资产。

攻击面

弱点类别分布

• 业务逻辑9
• 身份认证8
• 访问控制6
• 信息泄露5
• 跨站脚本4
• 注入与走私3
• 错误配置2
• 其他弱点2
• 不安全的直接对象引用1
• 拒绝服务1
• 路径遍历1
• 服务端请求伪造1
• 内存破坏1

主要弱点

• 认证缺陷（通用）7
• 访问控制缺陷（通用）4
• Client-Side Enforcement of Server-Side Security4
• 信息泄露3
• HTTP 请求走私2
• 业务逻辑错误2
• Unlabeled2
• Unlabeled2
• 存储型 XSS2
• Unlabeled2

常见资产

• · 10
• dash.cloudflare.comURL · 8
• Cloudflare Zero Trust/Cloudflare OneOTHER · 3
• *.cloudflare.comURL · 3
• WARP Mobile AppsOTHER · 3
• Cloudflare AccessOTHER · 2
• Open source tools from CloudflareOTHER · 2
• Cloudflare PagesOTHER · 2
• http://github.com/cloudflareURL · 2
• Cloudflare R2OTHER · 2

高票报告

当前状态 44 份 · 全部 44

1. 116
   HTTP Request Smuggling in Transform Rules using hexadecimal escape sequences in the concat() function注入与走私 · 2022-05-16 · 严重
   $6,000HTTP 请求走私
2. 97
   Cloudflare CASB Confused Deputy Problem其他弱点 · 2023-06-07 · 严重
   $3,300Unlabeled
3. 78
   Using special IPv4-mapped IPv6 addresses to bypass local IP ban业务逻辑 · 2023-01-24 · 严重
   $7,500Unlabeled
4. 77
   Bypass of Cloudflare's Cache Keys and WAF via header overflow访问控制 · 2025-11-18 · 高危
   $0访问控制缺陷（通用）
5. 76
   Hijack all emails sent to any domain that uses Cloudflare Email Forwarding访问控制 · 2022-07-29 · 严重
   $6,000授权不当
6. 75
   `use-mcp`'s oauth2 process uses a window.open call with untrusted mcp server provided data allowing for code execution under the page using it跨站脚本 · 2025-09-30 · 中危
   $550XSS（通用）
7. 68
   Yet Another CASB Integration Takeover of Active Integrations错误配置 · 2023-11-13 · 高危
   $0Unlabeled
8. 63
   [Variation of #3321406] YetAnother 1-Click Chaining of Self-XSS, Cookie Tossing and AntiCSRF Token Prediction leads to auto approval in AccessTempAuth跨站脚本 · 2026-04-14 · 高危
   $0存储型 XSS
9. 62
   AI Playground XSS to steal user-chat messages and access to connected MCP Server跨站脚本 · 2026-02-27 · 低危
   $0反射型 XSS
10. 57
    Bypass R2 payment screen身份认证 · 2023-11-10 · 中危
    $350认证尝试次数未限制
11. 54
    HTTP Request Smuggling via Unsanitized Hop-by-Hop Headers访问控制 · 2026-09-14 · 高危
    $1,500访问控制缺陷（通用）
12. 54
    Blind SSRF on platform.dash.cloudflare.com Due to Sentry misconfiguration服务端请求伪造 · 2022-08-31 · 低危
    $0SSRF
13. 50
    Second-Order XSS via javascript protocol in MCP Server Portal Apps leads to ATO跨站脚本 · 2025-12-16 · 低危
    $0存储型 XSS
14. 46
    Any WARP User Can Access Organization-Specific Application身份认证 · 2025-05-20 · 低危
    $0认证缺陷（通用）
15. 46
    HTTP request smuggling with Origin Rules using newlines in the host_header action parameter注入与走私 · 2022-06-28 · 严重
    $3,100HTTP 请求走私
16. 43
    Accessing apps protected via ZT's Access when user account is deleted/disabled even after clearing user session/seat身份认证 · 2023-10-25 · 高危
    $0认证缺陷（通用）
17. 40
    Enable 2Fa verification without verifying email访问控制 · 2022-08-31 · 中危
    $0访问控制缺陷（通用）
18. 40
    Arbitrary file read from Cloudflare Pages build environment路径遍历 · 2024-02-23 · 中危
    $0Unlabeled
19. 40
    Signup with any Email and Enable 2-FA without verifying Email身份认证 · 2022-09-12 · 中危
    $0认证缺陷（通用）
20. 39
    [Variation of #1554049] 1-Click Chaining of Self-XSS, Cookie Tossing and AntiCSRF Token Prediction leads to auto approval in Access Temp Auth信息泄露 · 2026-04-14 · 高危
    $0Unlabeled
21. 36
    Bypassing Cache Deception Armor using .avif extension file信息泄露 · 2022-06-28 · 中危
    $0信息泄露
22. 34
    Bypass two-factor authentication身份认证 · 2022-10-04 · 低危
    $250认证缺陷（通用）
23. 34
    A malicious actor could rotate tokens of a victim, given that he knows the victim's token ID访问控制 · 2023-04-13 · 高危
    $0访问控制缺陷（通用）
24. 32
    Sign in with Apple works on existing accounts, bypasses 2FA身份认证 · 2022-06-28 · 高危
    $1,000认证缺陷（通用）
25. 29
    💥💥Crash report -Cloudflare WARP doesn't verify text length in "Excluded Host" name input data💥💥内存破坏 · 2023-07-31 · 低危
    $0内存破坏（通用）