Emergency WAF release adds Free Ruleset detections
The release adds detections to both the Cloudflare Managed Ruleset and the Cloudflare Free Ruleset. The rule set is aimed at unauthenticated remote code execution and SQL injection attempts that ride through framework request handling before the application has a chance to clean them up.
The RCE case is ugly but familiar: malicious input with invalid path sequences can reach request processing and trigger command execution with web server privileges. The SQL injection case is simpler and just as unpleasant: unsanitised request parameter values can be turned into database queries. In both cases, the firewall is trying to catch exploitation traffic before the framework does something foolish with it.
The named detections are not subtle. Cloudflare marks them as new detections, and the new action is block. That matters because these are not advisory signatures or “watch and wait” controls. They are stop signs.
What the new detections block in practice
The managed rules are meant to block active exploitation attempts, not general badness. That means the coverage sits around request content that matches known attack behaviour in vulnerable web frameworks, especially where path handling or parameter parsing has gone wrong.
For the RCE path, the failure mode is unauthenticated input reaching logic that should never have trusted it. Invalid path sequences can be enough to drive command execution during request processing, which is a clean reminder that validation after routing is often too late. For the SQL injection path, the fault line is request parameters that are fed into queries without sanitisation. If user input can still shape SQL, the application firewall has a very simple job: stop the request before it reaches the database.
This is not a full fix. A WAF can block a known attack pattern, but it cannot repair broken request handling, weak sanitisation, or unsafe framework use. It buys time and cuts exposure while the application side catches up.
Why the release lands on request handling rather than the edge
The interesting part is where the attack lands. These exploitation chains do not start with some exotic edge condition. They start when a request reaches framework code that trusts malformed path data or unsanitised parameters.
That is why request handling matters more than the usual outer edge story here. The edge can reject obvious junk, but the real risk sits in the application layer where routing, parsing, and query construction happen. If a framework accepts invalid path sequences or passes raw parameter values into SQL, the damage happens after the request is already inside the fence.
A managed ruleset is a useful backstop in that space. It gives you a block action on traffic patterns that match live exploitation, which is a better outcome than waiting for the application to fail in production. It also fits the reality of emergency patching, where some deployments cannot be rebuilt in an hour and some vendors ship fixes slower than attackers ship payloads.
Where to check coverage and what to confirm after deployment
Check whether the relevant managed ruleset is enabled in the zone and whether the Free Ruleset is also active if that is what the account uses. The release includes these rule IDs:
- 550664b6
- ed933fcc
- b5ec246a
- 33697a1a
After deployment, confirm that the action is set to block and that the detection is live in the expected zones. If the application already sits behind a separate application firewall policy, make sure the new managed rules do not get overridden by a looser local exception. A bad override is a neat way to preserve the attack surface while telling yourself the firewall is on.
It is also worth checking whether your frameworks are exposed to the path handling or request parameter patterns these rules are meant to catch. If the WAF starts firing, that is useful telemetry, not a substitute for fixing request sanitisation, patching the framework, or removing whatever brittle route logic made invalid input dangerous in the first place.
