La soci\u00e9t\u00e9 Cloudflare, qui fournit un r\u00e9seau de distribution de contenu g\u00e9rant environ 20 % du trafic Internet, a publi\u00e9 un rapport sur le piratage d'un de ses serveurs, o\u00f9 fonctionnaient un wiki interne bas\u00e9 sur la plateforme Atlassian Confluence, un syst\u00e8me de suivi des erreurs Atlassian Jira et un syst\u00e8me de gestion de code Bitbucket. L'analyse a r\u00e9v\u00e9l\u00e9 que l'attaquant avait pu acc\u00e9der au serveur en utilisant des tokens obtenus lors du piratage d'Okta en octobre, qui avait conduit \u00e0 la fuite de tokens d'acc\u00e8s. <\/p>\n
Apr\u00e8s la divulgation \u00e0 l'automne des informations sur le piratage d'Okta, Cloudflare a lanc\u00e9 un processus de mise \u00e0 jour des identifiants, cl\u00e9s et tokens utilis\u00e9s via les services d'Okta, mais il s'est av\u00e9r\u00e9 qu'un token et trois comptes (sur plusieurs milliers) compromis lors du piratage d'Okta n'avaient pas \u00e9t\u00e9 remplac\u00e9s et continuaient \u00e0 fonctionner, ce dont a profit\u00e9 l'attaquant. Les identifiants mentionn\u00e9s \u00e9taient consid\u00e9r\u00e9s comme inactifs, mais permettaient en r\u00e9alit\u00e9 d'acc\u00e9der \u00e0 la plateforme Atlassian, au syst\u00e8me de gestion de code Bitbucket, \u00e0 une application SaaS ayant un acc\u00e8s administratif \u00e0 l'environnement Atlassian Jira, ainsi qu'\u00e0 un environnement AWS desservant le catalogue Cloudflare Apps, mais n'ayant pas acc\u00e8s \u00e0 l'infrastructure CDN et ne contenant pas de donn\u00e9es confidentielles. <\/p>\n
L'incident n'a pas touch\u00e9 les donn\u00e9es et syst\u00e8mes des utilisateurs de Cloudflare. Un audit a r\u00e9v\u00e9l\u00e9 que l'attaque s'\u00e9tait limit\u00e9e aux syst\u00e8mes ayant des produits Atlassian et ne s'\u00e9tait pas \u00e9tendue \u00e0 d'autres serveurs<\/a>, gr\u00e2ce \u00e0 l'application par Cloudflare d'un mod\u00e8le de confiance z\u00e9ro (Zero Trust) et \u00e0 l'isolation des diff\u00e9rentes parties de l'infrastructure. <\/p>\n Le piratage du serveur Cloudflare a \u00e9t\u00e9 d\u00e9couvert le 23 novembre, et les premi\u00e8res traces d'acc\u00e8s non autoris\u00e9 au wiki et au syst\u00e8me de suivi des erreurs ont \u00e9t\u00e9 enregistr\u00e9es le 14 novembre. Le 22 novembre, l'attaquant a install\u00e9 un backdoor pour obtenir un acc\u00e8s permanent, cr\u00e9\u00e9 \u00e0 l'aide de ScriptRunner pour Jira. Ce jour-l\u00e0, l'attaquant a \u00e9galement eu acc\u00e8s au syst\u00e8me de gestion du code source, o\u00f9 la plateforme Atlassian Bitbucket \u00e9tait utilis\u00e9e. Suite \u00e0 cela, une tentative de connexion a \u00e9t\u00e9 entreprise \u00e0 la console serveur<\/a>, utilis\u00e9e pour acc\u00e9der \u00e0 un data center encore non op\u00e9rationnel au Br\u00e9sil, mais toutes les tentatives de connexion ont \u00e9chou\u00e9. <\/p>\n Apparemment, l'activit\u00e9 de l'attaquant s'est limit\u00e9e \u00e0 l'\u00e9tude de l'architecture du r\u00e9seau de distribution de contenu et \u00e0 la recherche de vuln\u00e9rabilit\u00e9s. Dans le cadre de ses activit\u00e9s, l'attaquant a utilis\u00e9 une recherche dans wiki avec des mots-cl\u00e9s li\u00e9s \u00e0 l'acc\u00e8s \u00e0 distance, des secrets, openconnect, cloudflared et des jetons. L'ouverture de 202 pages wiki (sur 194100) et de 36 rapports de probl\u00e8mes (sur 2059357), li\u00e9s \u00e0 la gestion des correctifs de s\u00e9curit\u00e9 et \u00e0 la rotation des cl\u00e9s, a \u00e9t\u00e9 enregistr\u00e9e. De plus, 120 d\u00e9p\u00f4ts de code (sur 11904) ont \u00e9t\u00e9 t\u00e9l\u00e9charg\u00e9s, la plupart \u00e9tant li\u00e9s \u00e0 la sauvegarde, \u00e0 la configuration et \u00e0 la gestion des CDN, aux syst\u00e8mes d'identification, \u00e0 l'acc\u00e8s \u00e0 distance, ainsi qu'\u00e0 l'utilisation des plateformes Terraform et Kubernetes. Certains de ces d\u00e9p\u00f4ts contenaient des cl\u00e9s chiffr\u00e9es laiss\u00e9es dans le code, qui ont \u00e9t\u00e9 remplac\u00e9es imm\u00e9diatement apr\u00e8s l'incident, malgr\u00e9 l'utilisation de m\u00e9thodes de chiffrement fiables. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0430\u044f \u0441\u0435\u0442\u044c \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430, \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0449\u0443\u044e \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e 20% \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043e\u0442\u0447\u0451\u0442 \u043e \u0432\u0437\u043b\u043e\u043c\u0435 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0432 \u0441\u0432\u043e\u0435\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0439 wiki-\u0441\u0430\u0439\u0442 \u043d\u0430 \u0431\u0430\u0437\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Atlassian Confluence, \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u043e\u0448\u0438\u0431\u043e\u043a Atlassian Jira \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u043e\u043c Bitbucket. \u0420\u0430\u0437\u0431\u043e\u0440 \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0441\u043c\u043e\u0433 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443, \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0432\u0448\u0438\u0441\u044c \u0442\u043e\u043a\u0435\u043d\u0430\u043c\u0438, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u043c\u0438 \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043e\u043a\u0442\u044f\u0431\u0440\u044c\u0441\u043a\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-113361","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Cloudflare a r\u00e9v\u00e9l\u00e9 des informations sur le piratage de l'un de ses serveurs | ProHoster","description":"Cloudflare, la soci\u00e9t\u00e9 fournissant une r\u00e9seau de distribution de contenu qui g\u00e8re environ 20 % du trafic Internet, a publi\u00e9 un rapport sur le piratage de l'un de ses serveurs dans son infrastructure, sur lequel fonctionnait un service interne.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/kompaniya-cloudflare-raskryla-svedeniya-o-vzlome-odnogo-iz-svoih-serverov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e \u0432\u0437\u043b\u043e\u043c\u0435 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0441\u0432\u043e\u0438\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0430\u044f \u0441\u0435\u0442\u044c \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430, \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0449\u0443\u044e \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e 20% \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0442\u0440\u0430\u0444\u0438\u043a\u0430, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043e\u0442\u0447\u0451\u0442 \u043e \u0432\u0437\u043b\u043e\u043c\u0435 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0432 \u0441\u0432\u043e\u0435\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043b \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0439.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/kompaniya-cloudflare-raskryla-svedeniya-o-vzlome-odnogo-iz-svoih-serverov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-02-02T11:41:16+00:00","article:modified_time":"2024-02-02T11:41:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"113361","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 16:53:32","updated":"2026-02-09 21:41:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/113361","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=113361"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/113361\/revisions"}],"predecessor-version":[{"id":160155,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/113361\/revisions\/160155"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=113361"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=113361"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=113361"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Source : opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"