{"id":113361,"date":"2024-02-02T13:41:16","date_gmt":"2024-02-02T11:41:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kompaniya-cloudflare-raskryla-svedeniya-o-vzlome-odnogo-iz-svoih-serverov"},"modified":"2024-02-02T13:41:16","modified_gmt":"2024-02-02T11:41:16","slug":"kompaniya-cloudflare-raskryla-svedeniya-o-vzlome-odnogo-iz-svoih-serverov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/kompaniya-cloudflare-raskryla-svedeniya-o-vzlome-odnogo-iz-svoih-serverov","title":{"rendered":"Cloudflare has disclosed information about the breach of one of its servers.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Cloudflare, a content delivery network serving approximately 20% of internet traffic, has published a report about the breach of one of its servers, which hosted an internal wiki site based on the Atlassian Confluence platform, the Atlassian Jira bug tracking system, and the Bitbucket code management system. The investigation revealed that the attacker gained access to the server by exploiting tokens obtained during the October breach of Okta, which led to a token leak. <\/p>\n

Following the disclosure in the fall about the Okta breach, Cloudflare initiated a process to update credentials, keys, and tokens used through Okta services, but it turned out that one token and three accounts (out of several thousand) compromised as a result of the Okta breach were not replaced and continued to operate, which the attacker exploited. These credentials were considered unused but allowed access to the Atlassian platform, the Bitbucket code management system, a SaaS application with administrative access to the Atlassian Jira environment, and an AWS environment serving the Cloudflare Apps catalog, but having no access to the CDN infrastructure or storing sensitive data. <\/p>\n

The incident did not affect Cloudflare users' data and systems. An audit determined that the attack was limited to systems with Atlassian products and did not spread to others servers<\/a>, thanks to Cloudflare's implementation of a zero-trust model and the isolation of infrastructure components. <\/p>\n

The breach of the Cloudflare server was detected on November 23, and the first signs of unauthorized access to the wiki and the bug tracking system were recorded on November 14. On November 22, the attacker installed a backdoor for persistent access, created using ScriptRunner for Jira. On the same day, the attacker accessed the source code management system that used the Atlassian Bitbucket platform. Following this, attempts were made to connect to the console server<\/a>, used for accessing a data center in Brazil that was not yet operational, but all connection attempts were unsuccessful. <\/p>\n

It appears that the attacker's activity was limited to examining the architecture of the content delivery network and searching for vulnerabilities. During their operation, the attacker used wiki searches with keywords related to remote access, secrets, openconnect, cloudflared, and tokens. The attacker accessed 202 wiki pages (out of 194,100) and 36 issue reports (out of 2,059,357) related to vulnerability management and key rotation. Additionally, 120 code repositories (out of 11,904) were downloaded, most of which were linked to backup, configuration, and management of CDN, identification systems, remote access, and the use of Terraform and Kubernetes platforms. Some of the repositories contained encrypted keys left in the code, which were replaced immediately after the incident despite the use of reliable encryption methods.
\n
Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0430\u044f \u0441\u0435\u0442\u044c \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430, \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0449\u0443\u044e \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e 20% \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043e\u0442\u0447\u0451\u0442 \u043e \u0432\u0437\u043b\u043e\u043c\u0435 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0432 \u0441\u0432\u043e\u0435\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0439 wiki-\u0441\u0430\u0439\u0442 \u043d\u0430 \u0431\u0430\u0437\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Atlassian Confluence, \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u043e\u0448\u0438\u0431\u043e\u043a Atlassian Jira \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u043e\u043c Bitbucket. \u0420\u0430\u0437\u0431\u043e\u0440 \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0441\u043c\u043e\u0433 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443, \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0432\u0448\u0438\u0441\u044c \u0442\u043e\u043a\u0435\u043d\u0430\u043c\u0438, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u043c\u0438 \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043e\u043a\u0442\u044f\u0431\u0440\u044c\u0441\u043a\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-113361","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Cloudflare Reveals Details About the Breach of One of Its Servers | ProHoster","description":"Cloudflare, the content delivery network that serves approximately 20% of internet traffic, has published a report about the breach of one of the servers in its infrastructure that was running internally.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/kompaniya-cloudflare-raskryla-svedeniya-o-vzlome-odnogo-iz-svoih-serverov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u0432\u0437\u043b\u043e\u043c\u0435 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0441\u0432\u043e\u0438\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0430\u044f \u0441\u0435\u0442\u044c \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430, \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0449\u0443\u044e \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e 20% \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043e\u0442\u0447\u0451\u0442 \u043e \u0432\u0437\u043b\u043e\u043c\u0435 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0432 \u0441\u0432\u043e\u0435\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0439.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/kompaniya-cloudflare-raskryla-svedeniya-o-vzlome-odnogo-iz-svoih-serverov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-02-02T11:41:16+00:00","article:modified_time":"2024-02-02T11:41:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"113361","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 16:53:32","updated":"2026-02-09 21:41:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/113361","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=113361"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/113361\/revisions"}],"predecessor-version":[{"id":160155,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/113361\/revisions\/160155"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=113361"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=113361"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=113361"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}