Using a Content Delivery Network (CDN) or a Web Application Firewall (WAF) is a standard TTP for defenders looking to mitigate DDoS attacks and hide backend infrastructure from direct exposure. However, the protection offered by these services is only effective if the backend server—the origin—remains hidden. If an attacker can identify the direct IP address of the origin server, they can bypass the WAF’s security rules, rate limiting, and filtering entirely. According to the SANS Internet Storm Center, researchers and threat actors alike employ several distinct methods to unmask these hidden servers.
How to Detect Origin IP Leaks and Backend Exposure
One of the most common ways to identify origin server IP for Cloudflare sites involves investigating DNS misconfigurations and historical records. When a site migrates to a cloud proxy, previous DNS records may still exist in third-party databases. Services that archive DNS history can reveal what the server’s IP address was before it was proxied. Furthermore, organizations often forget to proxy all subdomains. While www.example.com might be protected, subdomains like dev.example.com, direct.example.com, or mail.example.com might point directly to the origin server. Finding these IoC precursors is a fundamental step in the reconnaissance phase of an attack.
Technical Discovery via TLS Fingerprinting
Modern internet scanners such as Censys and Shodan have made it significantly easier to find origin servers through TLS certificate matching. If a backend server is configured with a valid TLS certificate for the domain it serves, that certificate often contains the domain name in the Common Name (CN) or Subject Alternative Name (SAN) fields. An attacker can search global scanning databases for the specific certificate associated with a target domain. If the origin server responds to a direct IP-based connection request on port 443 with that certificate, the identity of the backend is confirmed. This bypasses the cloud provider’s protection because the server is effectively ‘announcing’ its identity to anyone scanning the IPv4 address space.
Exploiting Outbound Application Leaks
Beyond passive DNS and certificate analysis, attackers may use active methods to force the server to reveal itself. This occurs when the application is tricked into making an outbound connection to a server controlled by the attacker. Common triggers include:
- Webhooks: If an application allows users to define a webhook URL, the server will initiate a POST request to that URL, revealing its origin IP in the web server logs of the receiver.
- RSS Readers or URL Previewers: If a site fetches metadata from a user-provided link to generate a preview, the request originates from the backend server.
- SSRF Vulnerabilities: A successful RCE or Server-Side Request Forgery attempt can be used to pivot and identify internal network configurations or force the server to communicate with an external C2 listener.
Monitoring for these outbound connections in a SIEM is vital for any SOC to identify when backend infrastructure is being probed or mapped by unauthorized parties.
Remediation and Origin Hardening
To ensure a resilient Cloudflare origin server security configuration, administrators must implement strict access control lists (ACLs). The origin server should be configured to drop all traffic that does not originate from the CDN’s known IP ranges. For Cloudflare, this involves updating local firewalls (iptables, nftables, or cloud security groups) to only allow ingress from their published IP prefixes.
Furthermore, defenders should implement Authenticated Origin Pulls. This feature uses a client certificate to verify that the request hitting the origin is actually coming from the CDN and not a direct connection from an attacker. Finally, rotating origin IPs after a leak is discovered and ensuring that no ‘leaky’ subdomains are exposed in the DNS zone are critical maintenance tasks for maintaining a secure posture.
Related: Routing Non-Proxy-Aware Application Traffic for Security Analysis, Cisco SD-WAN CVE-2023-20252 Exploited via Rogue Peering - Patch Now