Description

Ensure the Cloudflare OWASP Core Ruleset is deployed and turned on for the zone. This managed ruleset is Cloudflare's version of the OWASP ModSecurity Core Rule Set and scores requests for signs of common attacks from the OWASP Top 10.

Rationale

The OWASP Top 10 lists the most common and serious web application risks, such as injection and cross-site scripting. The OWASP Core Ruleset adds a second layer of generic attack detection on top of the Cloudflare Managed Ruleset, catching attack patterns even when there is no specific rule for a vulnerability.

Impact

  • Adds protection against OWASP Top 10 attacks

  • Blocks requests with a high attack score

  • May cause false positives at higher paranoia levels, so tune carefully

Default Value

By default, the OWASP Core Ruleset is not deployed. It is available on Pro, Business, and Enterprise plans, and deploys with paranoia level PL1 and a Medium score threshold.

Pre-Requisites

  • Cloudflare account with Administrator or Firewall permissions for the zone

  • Pro, Business, or Enterprise plan

Test Plan

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to Security > Settings and (optionally) filter by Web application exploits. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.

  4. Verify that the OWASP Core Ruleset is turned on.

  5. If it is off, follow the implementation steps.

Implementation Steps

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to Security > Settings and (optionally) filter by Web application exploits. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.

  4. Turn on the Cloudflare OWASP Core Ruleset. It deploys with paranoia level PL1 and a Medium score threshold.

  5. Review Security > Analytics for blocked requests, and adjust the score threshold or add exceptions for false positives.

Backout Plan

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to Security > Settings and (optionally) filter by Web application exploits. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.

  4. Turn off the Cloudflare OWASP Core Ruleset.

Reference