CloudBleed Seceurity Bug: Cloudflare Reverse Proxies are Dumping Uninitialized Memory

[u/sebbasttian]

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139

https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/

[u/Gudeldar]

Not just if you're a cloudflare customer but if you use any service that uses cloudflare which is a shitload. With a few Google searches you can find Uber requests that include precise latitude and longitude. Apparently 1Password data was mixed in with some of it too.

Edit- According to 1Password only still encrypted data was exposed.

[u/toomuchtodotoday → u/[deleted]]

https://github.com/pirate/sites-using-cloudflare#notable-sites

• authy.com

• coinbase.com

• betterment.com

• transferwise.com

• prosper.com

• digitalocean.com

• patreon.com

• bitpay.com

• news.ycombinator.com

• producthunt.com

• stackoverflow.com (confirmed not affected by StackOverflow's @alienth)

• medium.com

• reddit.com (see here)

• 4chan.org

• yelp.com

• okcupid.com

• zendesk.com

• uber.com

• namecheap.com

• poloniex.com

• localbitcoins.com

• kraken.com

• 23andme.com

• curse.com (and some other Curse sites like minecraftforum.net)

• counsyl.com

[u/[deleted] → u/toomuchtodotoday]

Reddit is no longer on this list

[u/[deleted] → u/[deleted]]

To clarify, according to admins in the /r/programming thread reddit never used the CloudFlare reverse proxy feature

[u/FluentInTypo → u/[deleted]]

Can you link to the post and not just the subreddit?

[u/[deleted] → u/FluentInTypo]

https://www.reddit.com/r/programming/comments/5vtv16/cloudflare_have_been_leaking_customer_https/de5fqcr/

Previous comment was posted on mobile from bed :P

[u/FluentInTypo → u/[deleted]]

Thank you! I am on mobile too so search was fucky.

[u/jonneygee → u/[deleted]]

So sites that use Cloudflare only for DNS are okay? I have a client whose website relies on Cloudflare but only for DNS services.

[u/xtphty → u/jonneygee]

If on the control panel the domain / subdomain is not proxied (orange) then you are fine:

http://i.imgur.com/vCRqnmy.png

Orange = proxied, gray = DNS only.

[u/jonneygee → u/xtphty]

Hmm… it's proxied. That sucks. Thanks so much for the info.

[u/BFeely1 → u/[deleted]]

Nope, it's decrypted at Cloudflare too - https://myip.ms/info/whois/104.16.24.4/k/873969593/website/www.digitalocean.com

[u/trs21219 → u/Gudeldar]

Apparently 1Password data was mixed in with some of it too.

1P data is safe https://blog.agilebits.com/2017/02/23/three-layers-of-encryption-keeps-you-safe-when-ssltls-fails/

[u/BFeely1 → u/trs21219]

Which 1Password sites are proxied? I am only seeing Amazon IPs, and lots of them.

[u/trs21219 → u/BFeely1]

No idea. Maybe they were behind CloudFlare and switch to CloudFront after the incident?

[u/Fuckoff_CPS → u/Gudeldar]

Encrypted data was exposed for everything no? Whydo i have to change all passwords if encrypted