<story><title>Cloudflare Reverse Proxies Are Dumping Uninitialized Memory</title><url>https://bugs.chromium.org/p/project-zero/issues/detail?id=1139</url></story><parent_chain><item><author>espadrine</author><text>It is far from over, too! Google Cache still has loads of sensitive information, a link away!&lt;p&gt;Look at this, click on the downward arrow, &amp;quot;Cached&amp;quot;: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.google.com&amp;#x2F;search?q=&amp;quot;CF-Host-Origin-IP:&amp;quot;+&amp;quot;authorization:&amp;quot;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.google.com&amp;#x2F;search?q=&amp;quot;CF-Host-Origin-IP:&amp;quot;+&amp;quot;author...&lt;/a&gt;&lt;p&gt;(And then, in Google Cache, &amp;quot;view source&amp;quot;, search for &amp;quot;authorization&amp;quot;.)&lt;p&gt;(Various combinations of HTTP headers to search for yield more results.)</text></item><item><author>tptacek</author><text>Oh, my god.&lt;p&gt;Read the whole event log.&lt;p&gt;If you were behind Cloudflare and it was proxying sensitive data (the contents of HTTP POSTs, &amp;amp;c), they&amp;#x27;ve potentially been spraying it into caches all across the Internet; it was so bad that Tavis found it by accident just looking through Google search results.&lt;p&gt;The crazy thing here is that the Project Zero people were joking last night about a disclosure that was going to keep everyone at work late today. And, this morning, Google announced the SHA-1 collision, which everyone (including the insiders who leaked that the SHA-1 collision was coming) thought was the big announcement.&lt;p&gt;Nope. A SHA-1 collision, it turns out, is the &lt;i&gt;minor&lt;/i&gt; security news of the day.&lt;p&gt;This is approximately as bad as it ever gets. A significant number of companies probably need to compose customer notifications; it&amp;#x27;s, at this point, very difficult to rule out unauthorized disclosure of anything that traversed Cloudflare.</text></item></parent_chain><comment><author>PuffinBlue</author><text>&amp;gt; The infosec team worked to identify URIs in search engine caches that had leaked memory and get them purged. With the help of Google, Yahoo, Bing and others, we found 770 unique URIs that had been cached and which contained leaked memory. Those 770 unique URIs covered 161 unique domains. The leaked memory has been purged with the help of the search engines.&lt;p&gt;So I tried it too, and there&amp;#x27;s still data cached there.&lt;p&gt;Am I misunderstanding something - that above statement must be wrong, surely?&lt;p&gt;They can&amp;#x27;t have found everything even in the big search engines if it&amp;#x27;s still showing up in Google&amp;#x27;s cache, let alone the infinity other caches around the place.&lt;p&gt;EDIT: If the cloudflare team sees I see leaked credentials for these domains:&lt;p&gt;android-cdn-api.fitbit.com&lt;p&gt;iphone-cdn-client.fitbit.com&lt;p&gt;api-v2launch.trakt.tv</text></comment>
<story><title>Cloudflare Reverse Proxies Are Dumping Uninitialized Memory</title><url>https://bugs.chromium.org/p/project-zero/issues/detail?id=1139</url></story><parent_chain><item><author>espadrine</author><text>It is far from over, too! Google Cache still has loads of sensitive information, a link away!&lt;p&gt;Look at this, click on the downward arrow, &amp;quot;Cached&amp;quot;: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.google.com&amp;#x2F;search?q=&amp;quot;CF-Host-Origin-IP:&amp;quot;+&amp;quot;authorization:&amp;quot;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.google.com&amp;#x2F;search?q=&amp;quot;CF-Host-Origin-IP:&amp;quot;+&amp;quot;author...&lt;/a&gt;&lt;p&gt;(And then, in Google Cache, &amp;quot;view source&amp;quot;, search for &amp;quot;authorization&amp;quot;.)&lt;p&gt;(Various combinations of HTTP headers to search for yield more results.)</text></item><item><author>tptacek</author><text>Oh, my god.&lt;p&gt;Read the whole event log.&lt;p&gt;If you were behind Cloudflare and it was proxying sensitive data (the contents of HTTP POSTs, &amp;amp;c), they&amp;#x27;ve potentially been spraying it into caches all across the Internet; it was so bad that Tavis found it by accident just looking through Google search results.&lt;p&gt;The crazy thing here is that the Project Zero people were joking last night about a disclosure that was going to keep everyone at work late today. And, this morning, Google announced the SHA-1 collision, which everyone (including the insiders who leaked that the SHA-1 collision was coming) thought was the big announcement.&lt;p&gt;Nope. A SHA-1 collision, it turns out, is the &lt;i&gt;minor&lt;/i&gt; security news of the day.&lt;p&gt;This is approximately as bad as it ever gets. A significant number of companies probably need to compose customer notifications; it&amp;#x27;s, at this point, very difficult to rule out unauthorized disclosure of anything that traversed Cloudflare.</text></item></parent_chain><comment><author>toyg</author><text>Lol, Google just purged that search.&lt;p&gt;EDIT: but there&amp;#x27;s still plenty of fish: &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;webcache.googleusercontent.com&amp;#x2F;search?q=cache:lw4K9G2F1WgJ:lightnetwork.ph&amp;#x2F;ofw-family-day-december-1&amp;#x2F;&amp;amp;num=1&amp;amp;hl=en&amp;amp;gl=uk&amp;amp;strip=0&amp;amp;vwsrc=1&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;webcache.googleusercontent.com&amp;#x2F;search?q=cache:lw4K9G2...&lt;/a&gt;&lt;p&gt;This will take weeks to clean, and that&amp;#x27;s just for Google.&lt;p&gt;EDIT2: found other oauth tokens, lots of fitbit calls... And this just by searching for typical CF internal headers on Google and Bing. There is no way to know what else is out there. What a mess.</text></comment>