Introducing full transaction detection for Cloudflare WAF

What it is

Cloudflare WAF now has full transaction detections and a response phase. A detection evaluates an HTTP request together with the origin's response. A response rule can then replace the origin response with a WAF block page and HTTP 403, or with a custom response. The page says this cannot undo actions the origin has already performed. The first managed protections cover the php2shell vulnerability. The page gives no mechanism or CVE id for php2shell.

How it works

Detection and mitigation are separate. Detections attach metadata to the request and response, and rules decide what to do with it. This mirrors the existing request-side Attack Signature Detection. Results are stored in fields under cf.waf.signature.response.*. The post says a list of these fields follows, but the list is missing from the fetched text.

The page's example is a path traversal such as GET /download?file=../../config/database.ini. The request alone cannot show whether the file was exposed. If the origin returns 200 with configuration-like text, the combination counts as stronger evidence than either signal alone. The page notes that configuration-like text can appear legitimately in documentation or example downloads.

What to do

Open Security > Security Rules in the Cloudflare dashboard. The response phase controls are at the bottom of the page.

• Managed: the Cloudflare Managed Response Firewall Default ruleset is a one-click deploy. A match blocks the response and returns the standard WAF block page. Its scope can be edited to exclude or restrict paths.
• Custom: the page's example blocks an exposed admin interface:

http.request.uri.path starts_with "/admin" and not http.request.headers["x-internal-user"][0] eq "true" and http.response.code eq 200 and http.response.headers["content-type"][0] contains "text/html"

It does not block ordinary authentication failures, redirects, or non-admin traffic.

• Review first: inspect detections in Security Analytics before writing a policy. Events from response rules appear in Security Events under the Managed Rules or Custom Rules service. You can filter them by rule ID.

Preconditions / Affected

Traffic must be proxied through Cloudflare. Managed and custom response rules are available on all plans, including Free. Free plans get managed detections focused on high-profile vulnerabilities. Paying customers can use the detection fields in custom response rules. They can also combine those fields with hostname, path, source IP or request headers to scope a rule to one path. The post says it plans a richer detection catalog for paying customers over time.

Caveats

• Each customer can create up to three custom response rules, with Log and Block actions only.
• Matching on the response body is not yet available.
• The cf.waf.signature.response.* fields are still rolling out. Accounts without them should contact their account team.
• Request-only and full-transaction events share one analytics page for now.
• The first detections target exploit confirmation for high-profile vulnerabilities. Data exposure and exfiltration detections are planned, not shipped.