Cloudflare Public Bug Bounty

Cloudflare Public Bug Bounty 的公开漏洞报告、类别分布与常见资产。

攻击面

弱点类别分布

• 业务逻辑9
• 身份认证8
• 访问控制6
• 信息泄露5
• 跨站脚本4
• 注入与走私3
• 错误配置2
• 其他弱点2
• 不安全的直接对象引用1
• 拒绝服务1
• 路径遍历1
• 服务端请求伪造1
• 内存破坏1

主要弱点

• 认证缺陷（通用）7
• 访问控制缺陷（通用）4
• Client-Side Enforcement of Server-Side Security4
• 信息泄露3
• HTTP 请求走私2
• 业务逻辑错误2
• Unlabeled2
• Unlabeled2
• 存储型 XSS2
• Unlabeled2

常见资产

• · 10
• dash.cloudflare.comURL · 8
• Cloudflare Zero Trust/Cloudflare OneOTHER · 3
• *.cloudflare.comURL · 3
• WARP Mobile AppsOTHER · 3
• Cloudflare AccessOTHER · 2
• Open source tools from CloudflareOTHER · 2
• Cloudflare PagesOTHER · 2
• http://github.com/cloudflareURL · 2
• Cloudflare R2OTHER · 2

高票报告

当前状态 44 份 · 全部 44

1. 28
   Take over subdomains of r2.dev using R2 custom domains其他弱点 · 2022-09-28 · 中危
   $1,125Unlabeled
2. 28
   API docs expose an active token for the sample domain theburritobot.com信息泄露 · 2022-06-28 · 高危
   $500信息泄露
3. 27
   Basic XSS [WAF Bypasses]业务逻辑 · 2023-07-07 · 未评级
   $50Unlabeled
4. 24
   YAML schema injection risk in Swagger UI via schema_url parameter at developers.cloudflare.com注入与走私 · 2023-11-10 · 低危
   $0资源注入
5. 23
   Cloudflare is not properly deleting user's account业务逻辑 · 2023-04-13 · 中危
   $0业务逻辑错误
6. 23
   cd=false (DNSSEC) not respected in DNS over HTTPS JSON requests业务逻辑 · 2022-12-12 · 低危
   $250业务逻辑错误
7. 21
   Origin IP address disclosure through Pingora response header信息泄露 · 2023-01-11 · 中危
   $0错误信息泄露
8. 21
   Completely remove VPN profile from locked WARP iOS cient.业务逻辑 · 2022-11-07 · 高危
   $1,000Client-Side Enforcement of Server-Side Security
9. 20
   I found another way to bypass Cloudflare Warp lock!业务逻辑 · 2022-11-07 · 高危
   $1,000Client-Side Enforcement of Server-Side Security
10. 19
    Bypassing creation of API tokens without email verification身份认证 · 2023-03-27 · 低危
    $0认证缺陷（通用）
11. 17
    Sign in with Apple generates long-life JWTs, seemingly irrevocable, that grant immediate access to accounts身份认证 · 2022-06-28 · 低危
    $250认证缺陷（通用）
12. 16
    Session mismatch leading to potential account takeover (local access required)不安全的直接对象引用 · 2023-04-10 · 中危
    $0IDOR
13. 12
    Extraction of Pages build scripts, config values, tokens, etc. via symlinks信息泄露 · 2023-03-07 · 中危
    $500信息泄露
14. 12
    Ability to bypass locked Cloudflare WARP on wifi networks.业务逻辑 · 2022-11-16 · 高危
    $1,000Client-Side Enforcement of Server-Side Security
15. 12
    Misconfigured build on websites "abuse.cloudflare.com"错误配置 · 2022-10-13 · 低危
    $100Unlabeled
16. 11
    Password Policy Restriction Bypass业务逻辑 · 2022-09-30 · 低危
    $0违反安全设计原则（按标题归类）
17. 10
    Privilege escalation to root in Pages build image v2访问控制 · 2023-05-26 · 低危
    $350权限提升
18. 10
    Bypass Cloudflare WARP lock on iOS.业务逻辑 · 2022-11-07 · 中危
    $500Client-Side Enforcement of Server-Side Security
19. 8
    Lack of Packet Sanitation in Goflow Results in Multiple DoS Attack Vectors and Bugs拒绝服务 · 2022-09-30 · 高危
    $500资源消耗失控