Back to Checks
cloudflare

Cloudflare Zone OWASP Managed WAF Rulesets Are Enabled

zone_waf_owasp_ruleset_enabled
Service: zoneSeverity: high
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:Zone

Cloudflare zones are assessed for OWASP managed rulesets by checking if they are enabled to protect against common web application vulnerabilities including SQL injection, XSS, and other OWASP Top 10 threats.

Prowler logoProwlerprowler-provider-cloudflare

Risk

Without OWASP managed rulesets, web applications are exposed to well-known attack vectors.

  • Confidentiality: SQL injection attacks can exfiltrate sensitive database contents
  • Integrity: XSS attacks can modify page content and steal session tokens
  • Availability: remote code execution can compromise server availability

Run this check with Prowler

Run in Prowler Cloud
Run
prowler cloudflare --checks zone_waf_owasp_ruleset_enabled

Recommendation

Enable OWASP Core Ruleset managed rules as part of a defense in depth strategy.

  • Protects against OWASP Top 10 vulnerabilities including SQLi and XSS
  • Regularly review and tune rule sensitivity based on application requirements
  • Monitor WAF analytics to identify and address false positives
  • Combine with custom rules for application-specific protection

Remediation

Terraform

# Enable OWASP managed WAF rulesets
resource "cloudflare_ruleset" "waf_owasp" {
  zone_id = "<ZONE_ID>"
  name    = "OWASP Managed Rules"
  kind    = "zone"
  phase   = "http_request_firewall_managed"
  rules {
    action = "execute"
    action_parameters {
      id = "4814384a9e5d4991b9815dcfc25d2f1f" # Cloudflare OWASP Core Ruleset
    }
    expression  = "true"
    description = "Execute Cloudflare OWASP Core Ruleset"
  }
}

Other

1Log in to the Cloudflare dashboard and select your account and domain
2Go to Security > WAF > Managed rules
3Enable the Cloudflare OWASP Core Ruleset
4Review and configure rule sensitivity based on your application
5Monitor WAF analytics to tune rules and reduce false positives

Check Code

from prowler.lib.check.models import Check, CheckReportCloudflare
from prowler.providers.cloudflare.services.zone.zone_client import zone_client


class zone_waf_owasp_ruleset_enabled(Check):
    """Ensure that OWASP managed WAF rulesets are enabled for Cloudflare zones.

    The OWASP Core Ruleset provides protection against common web application
    vulnerabilities including SQL injection, cross-site scripting (XSS), and other
    OWASP Top 10 threats. These managed rulesets are essential for defense in depth
    and protecting applications from well-known attack vectors.
    """

    def execute(self) -> list[CheckReportCloudflare]:
        """Execute the OWASP WAF ruleset enabled check.

        Iterates through all Cloudflare zones and verifies that OWASP managed
        WAF rulesets are enabled. The check identifies OWASP rulesets by name
        containing "owasp" or by the http_request_firewall_managed phase.

        Returns:
            A list of CheckReportCloudflare objects with PASS status if OWASP
            rulesets are enabled, or FAIL status if no OWASP protection exists.
        """
        findings = []

        for zone in zone_client.zones.values():
            report = CheckReportCloudflare(
                metadata=self.metadata(),
                resource=zone,
            )

            # Find OWASP managed rulesets for this zone
            # Only match rulesets that explicitly contain "owasp" in the name
            # The phase check was too broad as it matched any managed ruleset
            owasp_rulesets = [
                ruleset
                for ruleset in zone.waf_rulesets
                if "owasp" in (ruleset.name or "").lower()
            ]

            if owasp_rulesets:
                report.status = "PASS"
                ruleset_descriptions = ", ".join(
                    ruleset.name for ruleset in owasp_rulesets
                )
                report.status_extended = (
                    f"Zone {zone.name} has OWASP managed WAF ruleset enabled: "
                    f"{ruleset_descriptions}."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Zone {zone.name} does not have OWASP managed WAF ruleset enabled."
                )
            findings.append(report)

        return findings

References