Enhancing WAF Security with Full Transaction Detection
Cloudflare introduces full transaction detection and response rules for its Web Application Firewall (WAF). This new capability evaluates both HTTP requests and their corresponding responses to identify complex exploitation patterns, moving beyond request-only analysis. It allows for more precise detection of vulnerabilities like data exposure or successful exploits, improving overall application security by enabling real-time blocking of malicious responses.
Read original on Cloudflare BlogTraditional Web Application Firewalls (WAFs) primarily focus on inspecting incoming HTTP requests to identify and block malicious traffic. While effective for many known attack patterns, this approach has limitations. Some sophisticated exploits or data exfiltration attempts only become apparent when the application's response is considered alongside the initial request.
The Challenge with Request-Only WAFs
Request-based WAF rules face a trade-off: broad rules can increase false positives by blocking legitimate traffic, while narrow rules might miss ambiguous but malicious requests. This dilemma arises because a request alone cannot definitively determine if an exploit attempt was successful or if sensitive data was exposed. An application might reject a suspicious request, ignore an attempted traversal, or return an error, making the intent or impact unclear without examining the response.
Path Traversal Example
Consider a path traversal attempt like `GET /download?file=../../config/database.ini`. A request-only WAF might block this. However, if the application successfully returns a `200 OK` with the `database.ini` content, it's a confirmed exploit. If it returns `404 Not Found` or `403 Forbidden`, the attempt failed. Full transaction detection differentiates between these outcomes.
Full Transaction Detection Architecture
Cloudflare's new full transaction detection extends the WAF by correlating incoming requests with outgoing responses. This allows for a more comprehensive analysis, where detections can identify evidence of exploitation by combining signals from both phases of an HTTP transaction. The system separates detection from mitigation, providing visibility into potential exploits before enforcement rules are applied.
- Detection Phase: Analyzes both request and response, attaching metadata like `cf.waf.signature.response.confidence` and `cf.waf.signature.response.categories`.
- Mitigation Phase: Response custom rules use these detection results (along with other request/response properties) to decide whether to block or modify the origin's response before it reaches the client.
- Event Logging: All blocked or logged transactions are available in Security Analytics, providing full context for investigation.
Key Capabilities and Benefits
This architectural enhancement allows for: stronger evidence of sensitive data exposure; improved accuracy by reducing false positives when blocking; and the ability to prevent sensitive information from reaching attackers in real-time by replacing malicious responses with WAF block pages. It provides a crucial layer of defense against evolving threats, especially those leveraged by AI agents that can adapt payloads based on application responses.
http.request.uri.path starts_with "/admin" and not http.request.headers["x-internal-user"][0] eq "true" and http.response.code eq 200 and http.response.headers["content-type"][0] contains "text/html"