Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

111–120 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#111

Post by AznHisoka »

tptacek wrote: post #4

Oh, my god. Read the whole event log. If you were behind Cloudflare and it was proxying sensitive data (the contents of HTTP POSTs, &c), they've potentially been spraying it into caches all across the Internet; it was so bad that Tavis found it by accident just looking through Google search results. The crazy thing here is that the Project Zero people were joking last night about a disclosure that was going to keep e…

Can someone tell me the implications of this in laymen terms?

For instance what does it mean "sprayed into caches"? what cache? dns cache? browser cache? if the latter, does it mean you are safe if the person who owns that cache is an innocent non technical iser?

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#112

Post by kalmi10 »

sparkling wrote: post #86
fagnerbrack wrote: post #64

TL;DR for the lazy ones: > The examples we're finding are so bad, I cancelled some weekend plans to go into the office on Sunday to help build some tools to cleanup. I've informed cloudflare what I'm working on. I'm finding private messages from major dating sites, full messages from a well-known chat service, online password manager data, frames from adult video sites, hotel bookings. We're talking full https reques…

I don't get it. How is this info leaked? From the blog posts, it seems that "only" the HTTP Headers are being leaked and somehow being crawled by Google? But since when does Google store HTTP request info? Can someone explain?

Headers (among other sensitive stuff) were being leaked inside document bodies.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#113

Post by jgrahamc »

tptacek wrote: post #108
jgrahamc wrote: post #98

Earlier quoted context omitted.

You really want to see Cloudflare spend more time discussing how they've quantified the leak here. What would you like to see? The SAFE_CHAR logging allowed us to get data on the rate which is how I got the % of requests figure.

How many different sites? Your team sent a list to Tavis's team. How many entries were on the list?

We identified 3,438 unique domains. I'm not sure if those were all sent to Tavis because we were only sending him things that we wanted purged.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#114

Post by fjarlq »

rdl wrote: post #31
tyingq wrote: post #27

Earlier quoted context omitted.

Sounds bad to me... "We've discovered (and purged) cached pages that contain private messages from well-known services, PII from major sites that use cloudflare, and even plaintext API requests from a popular password manager that were sent over https (!!)." The trouble is you have no way to know if someone discovered this earlier, and harvested info for a long time. Or, how much harvested info from your site might b…

Does 1Password really send anything meaningful in their API queries, or is it encrypted separately and then just sent over HTTPS?

For what it's worth, I've posted this question in 1Password's support forum, which is frequented by 1Password staff: https://discussions.agilebits.com/discussion/75711/cloudblee...

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#116

Post by arestor »

sparkling wrote: post #77

I know what Cloudflare is but i don't quite understand the underlying issue. Can someone explain in simpler terms what happened here and how it a) affects sites using Cloudflare and b) Users accessing sites with Cloudflare?

Some features had a bug which lead to uninitialized memory (AKA previous memory contents) in the output of a malformed HTML page was requested.

As one such server handles many sites, everything that the server handled before that request may be compromised. This includes all HTTP-GET/POST data (credentials, direct messages to other users, ...), Headers (API tokens, Login-Cookies) and contents.

So, you have to assume that everything you did on a CF "protected" website in the last months (especially between 2017-02-13 and 2017-02-17) is potentially compromised.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#120

Post by eridius »

JoshTriplett wrote: post #73
eridius wrote: post #29

Earlier quoted context omitted.

I don't buy this argument. A site using Flexible SSL is no less secure than one using http:// , and in fact is more secure, because nobody can MitM the connection between CloudFlare and the end user. The only thing vulnerable is the connection between the website and CloudFlare (~~and only to MitM, not to passive sniffing~~ EDIT: this isn't true, see [1]), but that's a much smaller and much better-protected surface a…

> A site using Flexible SSL is no less secure than one using http:// , It can be, in several ways. Most critically, it stops browsers from detecting the connection as insecure and applying mitigations.

Beyond Secure cookies, what mitigations are you thinking of? Secure cookies don't count because serving Secure cookies over Flexible SSL is no less secure than serving regular cookies over http://.
Post reply on HN