Cloudflare WAF Gains Full Transaction Analysis for Enhanced Threat Detection
Cloudflare's Web Application Firewall now analyzes both requests and responses, enabling detection of exploitation attempts by examining the full HTTP transaction.
Cloudflare has significantly upgraded its Web Application Firewall (WAF) with the introduction of two new capabilities: full transaction detection and response rules. This enhancement allows the WAF to inspect not only incoming HTTP requests but also their corresponding responses from the origin server. By correlating these two parts of a transaction, the WAF can more accurately identify evidence of exploitation, moving beyond analyzing requests in isolation.
The new functionality addresses the evolving threat landscape where sophisticated attackers, including AI-driven agents, can chain vulnerabilities, adapt payloads, and exploit weaknesses in widely used software. The recent php2shell vulnerability serves as a prime example of how a flaw in a common component can expose numerous applications. Attackers can use AI to persistently scan for vulnerabilities, and the application's response can reveal whether an exploit attempt was successful, providing crucial information for further compromise.
While inspecting incoming requests remains vital for blocking known attack patterns, some threats only become apparent when the request is viewed alongside the server's reaction. For instance, a suspicious request that, when processed, results in the exposure of sensitive information presents a much clearer picture of malicious intent than the request alone. Cloudflare's full transaction detection enables this deeper analysis by correlating the request with the response content.
With these new capabilities, customers can leverage Cloudflare-managed protections or create custom policies that incorporate both request and response properties. This extends Cloudflare's existing application security framework, with detection results integrated into Security Analytics for detailed investigation. The company has already rolled out managed protections specifically targeting the recently disclosed php2shell vulnerability, demonstrating the immediate applicability of this new feature.
Cloudflare emphasizes that these advanced detection capabilities are being made available to all customers, including those on free plans. This democratizes access to more robust security measures, allowing a wider range of users to benefit from enhanced protection against complex threats. The ability to analyze the full transaction provides a more definitive signal of compromise, reducing the ambiguity that can arise from request-only analysis.
The separation of detection and mitigation is a key design principle. Full transaction detection analyzes traffic and attaches metadata, while separate rules then determine the appropriate action. This approach provides security teams with visibility into detections before policy design, allowing them to understand which endpoints and signatures are involved and select the most suitable response for their specific application. New fields such as cf.waf.signature.response.confidence, cf.waf.signature.response.categories, and cf.waf.signature.response.ref have been added to the platform to provide detailed insights into response-based detections.
Initially, Cloudflare's full transaction detections will focus on confirming exploits for high-profile vulnerabilities by correlating suspicious input with response signals indicating a successful exploit. The company plans to expand this coverage over time to include other use cases, such as detecting data exposure and exfiltration signals. This expansion is critical for improving overall internet security by enabling defenses to distinguish between mere probing and actual impact, and by providing better protection for customers who may not have dedicated security operations.
This advancement represents a significant step forward in WAF technology, moving towards a more holistic understanding of web application security. By analyzing the complete HTTP transaction, Cloudflare aims to provide more accurate threat detection, reduce false positives, and enable more effective mitigation strategies against increasingly sophisticated cyberattacks.