Announcing CF update released Jul 14 2023: a second priority 1 security update in one week
Just days after a P1 security update released on Jul 11, Adobe has released yet another on Jul 14 (CF2023 update 2, CF2021 update 8, and CF2018 update 18). (I don't recall such a short gap between updates before, so yes: it's unusual.)
For more on the update, and some additional thoughts, read on.
I will note that while that post indicates that "There is currently no mitigation", that may not be the final/complete answer. Note how it refers to the _cfclient querystring, and notice that in my first post last week (on the Jul 11 CF update), I did point out how my March blog post on the previous CF update discussed ways to BLOCK ALL REQUESTS using that _cfclient querystring. I also elaborate there on what it's about, how one can determine if they may have any legit use of it (most do not), and much more. See https://www.carehart...
As I've said elsewhere, it's just not clear how many of the recently closed vulns DO work based on the _cfclient querystring. That post is about all we have to go on, as I've not seen any others. While those on cf2018 and above can apply these fixes to address what Adobe has found, it's just not clear (for now) what those on cf2016 can or should do, other than block requests with that querystring.