WAF - WAF Release - 2025-09-22

This week emphasizes two critical vendor-specific vulnerabilities: a full elevation-of-privilege in Microsoft Azure Networking (CVE-2025-54914) and a server-side template injection (SSTI) leading to remote code execution (RCE) in Skyvern (CVE-2025-49619). These are complemented by enhancements in generic detections (SQLi, SSRF) to improve baseline coverage. Key Findings Azure (CVE-2025-54914): Vulnerability in Azure Networking allowing elevation of privileges. Skyvern (CVE-2025-49619): Skyvern ≤ 0.1.85 has a server-side template injection (SSTI) vulnerability in its Prompt field (workflow blocks) via Jinja2. Authenticated users with low privileges can get remote code execution (blind). Generic SQLi / SSRF improvements: Expanded rule coverage to detect obfuscated SQL injection patterns and SSRF across host, local, and cloud contexts. Impact These vulnerabilities allow attackers to escalate privileges or execute code under conditions where previously they could not: Azure CVE-2025-54914 enables an attacker from the network with no credentials to gain high-level access within Azure Networking; could lead to full compromise of networking components. Skyvern CVE-2025-49619 allows authenticated users with minimal privilege to exploit SSTI for remote code execution, undermining isolation of workflow components. The improvements for SQLi and SSRF reduce risk from common injection and request-based attacks. Ruleset Rule ID Legacy Rule ID Description Previous Action New Action Comments Cloudflare Managed Ruleset c36a425ae0c94789a9bc34f06a135cbf 100146 SSRF - Host - 2 Log Disabled This is a New Detection Cloudflare Managed Ruleset dfa84b0aed5a4b45b953a36a57035abf 100146B SSRF - Local - 2 Log Disabled This is a New Detection Cloudflare Managed Ruleset 276073e60c7a4b4d91faba1fbbe18d50 100146C SSRF - Cloud - 2 Log Disabled This is a New Detection Cloudflare Managed Ruleset 78c856218f2d40f4b5988c8c956c1961 100714 Azure - Auth Bypass - CVE:CVE-2025-54914 Log Block This is a New Detection Cloudflare Managed Ruleset 9f1c8d4cbf3848dbb940771bc5ced231 100758 Skyvern - Remote Code Execution - CVE:CVE-2025-49619 Log Block This is a New Detection Cloudflare Managed Ruleset 6be7e7829f3b43c688e1ac4284a619a1 100773 Next.js - SSRF Log Block This is a New Detection Cloudflare Managed Ruleset 0cc3f50216bf4b448210bcc3983ff2dd 100774 Adobe Commerce - Remote Code Execution - CVE:CVE-2025-54236 Log Block This is a New Detection Cloudflare Managed Ruleset 53bfaeb311a049e3877fa15c0380a1a6 100800_BETA SQLi - Obfuscated Boolean - Beta Log Block This rule has been merged into the original rule (ID: 7663ea44178441a0b3205c145563445f )