Defences · Scan · first seen 1 Oct
HighLikelyFix submittedKelvin Obisesanfix by 31 Oct
Fix submitted by Kelvin · rescan running since 10:19
Ifeoma marked SEC-131 done in Jira. We close it when a complete scan can't reach the origin.
One problem in one place, found by scan.
1 source · 1 place
Scan
First found Thu 1 Oct, last seen Mon 12 Oct
What closes it
Nobody can mark it fixed by hand. A person submits the fix; a scan or a retest decides it.
20th of 39 in your queue
Proof first, then exploitation in the wild, a public exploit, EPSS and severity, adjusted for exposure and how much the asset matters
Priority
48 / 100
What each source saw
As each source gives it · secrets, keys and card numbers stay masked
The scan's case file · tessellatepay.com
See it in that scanWhy it matters here
Cloudflare protects app.tessellatepay.com, but its server's own address is in public certificate logs. Requests sent straight to it skip the firewall and rate limits.
What we saw
Cloudflare WAF can be bypassed: origin IP 18.133.42.7 is discoverable via ct-log-san (crt.sh:app.tessellatepay.com). An attacker hitting the IP directly skips the WAF entirely.
The fix
Only accept traffic from Cloudflare's addresses at the origin (a security group, or Authenticated Origin Pulls), and move the origin to a new address.
Where
What happened, and what was said
1 event · 0 comments · oldest first