Cloudbleed data leak flaw wasn't exploited: Cloudflare

Reverse proxy provider and content delivery network Cloudflare has claimed no leaked data was exploited in the serious Cloudbleed bug that was exposed last week.

Cloudflare founder Matthew Prince said company engineers had analysed log data over the past 12 days to figure out what the impact of Cloudbleed was on customers, in an attempt to allay fears that sensitive information such as passwords and digital keys had spilled out onto the internet.

The analysis of the log files has so far shown no evidence that Cloudbleed was exploited to gain access to sensitive data before the bug was patched, Prince said.

Search engines like Bing, Google, and Baidu that indexed Cloudflare sites cached some leaked data. However, Prince said a review of tens of thousands of pages with leaked data found internal Cloudflare headers and customer cookies, but no passwords, credit card numbers or health records.

Prince did not downplay the seriousness of the bug. 

"It was an extremely serious bug that caused data flowing through Cloudflare's network to be leaked onto the internet," he said.

"We fully patched the bug within hours of being notified. However, given the scale of Cloudflare, the impact was potentially massive."

He describe Cloudbleed as being "more akin to learning that a stranger may have listened in on two employees at your company talking over lunch".

In other words, Cloudbleed wasn't a targeted data breach; instead, while most of the information leaked would've been trivial, some might have been confidential data - except it would be difficult to know exactly what had been leaked.

Prince said in the over 80,000 pages that were cached by search engine - which were now purged - Cloudflare saw around 150 customers' data. Cloudflare has contacted the customers whose data was exposed to help them mitigate any impact.

He apologised for the debacle and promised to continue the analysis of the bug's impact. The company will also continue to review its code with help from auditing firm Veracode.