Origin Exposure Behind Edge CDN

Historical certificate transparency records exposed a direct-reachable origin IP behind the CDN edge. Any client on the public internet could reach the origin directly, bypassing edge WAF, rate-limit, and geo controls. The intended trust boundary at the edge no longer held.

Industry

Marketplace

Scope

Infrastructure · Edge · Origin

Timeline

R·Q2 → V·Q2 → R·Q2

Closed

Impact

Trust boundary

Edge → Origin boundary was not enforced

WAF bypass

All edge WAF rules bypassable

Rate-limit evasion

Edge rate limits bypassable; origin observed 5× traffic on direct path

Blast radius

Entire origin surface reachable from arbitrary IPs

Impact vectors

›Edge protections bypass
›Direct origin reachability
›Rate-limit evasion

Reproduction

Steps below reproduce the finding against a staging replica. Where the reproduction affected a shared component, coordination was arranged before execution.

01Enumerate historical CT log entries for the primary hostname.
02Extract origin IPs from prior certificates issued before the CDN was deployed.
03Reach the origin directly with a Host: header matching the primary hostname.
04Confirm origin responds identically to a CDN-fronted request, bypassing edge controls.

Vulnerability

Origin exposure (simplified)nginx

# origin listens on 0.0.0.0:443 with SNI-based routing.
# No client-cert or CDN-source restriction.
server {
    listen 443 ssl;
    server_name app.example.com;
    ssl_certificate     /etc/ssl/certs/app.pem;
    ssl_certificate_key /etc/ssl/private/app.key;
    location / { proxy_pass http://upstream; }
}

Mitigation

Client-side mitigation shipped and validated during the engagement. Reference patch below.

Origin locked to CDN source (post-fix)nginx

# origin only accepts connections from CDN edge IPs
# and requires a shared-secret header signed by the CDN.
geo $is_edge { default 0; include /etc/nginx/cdn-edges.conf; }

server {
    listen 443 ssl;
    server_name app.example.com;
    if ($is_edge = 0) { return 444; }
    if ($http_x_cdn_signature = "") { return 444; }
    location / {
        proxy_pass http://upstream;
        proxy_set_header X-Forwarded-For $remote_addr;
    }
}

Retest & Verify

✓Direct-IP reach attempts return TCP RST after CDN-source lockdown.
✓Signed CDN header validated end-to-end for all traffic reaching the origin.
✓CT-log audit repeated post-rotation — no additional origin IPs disclosed.
✓Edge WAF and rate-limit metrics reflect the full traffic profile again.

Deliverables

▊Technical Report (Markdown + PDF)
▊CT-log audit artifacts
▊Origin-lockdown Nginx patch
▊CDN-signature verification harness
▊Retesting report

Sign-off

Handled by

Epulyx

Reviewed by

Nolan

Closed

Case closed after CDN-source lockdown validation.

← All cases Discuss a similar case →