Malware uploads get an inline gate at the edge
Consider a typical job board. Applicants upload CVs, cover letters, and supporting documents every day. An attacker can just as easily upload a malicious file, and the application server is left to sort it out. Cloudflare is now addressing that gap with WAF Content Scanning, an engine that inspects uploaded content inline and surfaces results for WAF Custom Rules.
The feature is available to enterprise customers. It requires traffic to be proxied through the Cloudflare network; once that is in place, enabling it is a single API call. No application changes are needed, and file scanning runs inline with HTTP traffic.
Currently the engine handles files up to 1 MB. Requests with larger files can be blocked or logged with a custom rule. A simple rule to stop a known malicious file looks like:
if: (cf.waf.content_scan.has_malicious_obj)
then: BLOCK
In the dashboard, the rule appears as:
Writing rules with scan metadata
Beyond malware detection, the scan results expose fields that you can combine with other WAF logic. The engine provides details on content type and object presence, making it possible to enforce upload policies.
For an endpoint that should only accept PDFs, for example:
if: any(cf.waf.content_scan.obj_types[*] != "application/pdf") and http.request.uri.path eq "/upload"
then: BLOCK
If your application does not expect any uploads at all, you can reject any request that contains a content object:
if: (cf.waf.content_scan.has_obj)
then: BLOCK
Endpoints that accept JSON with embedded base64-encoded files can be handled too. A custom scan expression tells the engine where to look, and files inside JSON payloads are parsed, decoded, and scanned automatically. When a block is warranted, a custom JSON response type can be defined so the front end can parse and present the error:
How content objects are identified
Defining what constitutes a file in HTTP terms is tricky, which is why the system uses the phrase “content object.” The Content-Type header cannot be trusted — a payload declared as a jpeg image may actually be a pdf. The engine therefore relies on heuristics.
Today, a content object is any request payload that heuristics detect as something other than text/html, text/x-shellscript, application/json, or text/xml. Those text formats are intentionally skipped because scanning for attack vectors in them is already covered by the WAF, API Gateway, and other Cloudflare application security tools.
The engine also understands certain payload formats. When a payload is encoded as multipart/form-data, multipart/mixed, or JSON with base64-embedded objects (as defined by a customer’s custom scan expression), it parses the payload and scans individual components. This supports multiple content objects per request, such as an HTML form with several file inputs. If the engine finds a malicious match but cannot confidently detect the content type, it defaults to reporting application/octet-stream.
Scanning architecture
Cloudflare’s approach is to run the scanner on every edge server that handles customer traffic. Doing scans locally keeps latency impact minimal:
The underlying engine is identical to the one used in Cloudflare Web Gateway’s antivirus scanning. The main difference today is file size: WAF Content Scanning tops out at 1 MB, while Web Gateway supports up to 15 MB. Cloudflare says it is working to close that gap in the coming months.
Detection decoupled from mitigation
WAF Content Scanning separates detection from mitigation. Once enabled, it simply populates fields with scan results; you decide whether and how to act on them. The benefit of this approach is twofold.
First, it gives visibility without mandating any blocking. Security teams with large applications may not know which endpoints accept uploads from the internet. By filtering on requests with a content object in Security Analytics, they can surface top paths and hostnames handling uploads:
Second, because the intelligence is exposed as fields usable in WAF Custom Rules, you can build mitigation logic without learning a new interface. The Bot Management solution pioneered this model with its bot score field. Applying that pattern, a job site that wants to reject automated application submissions can now combine both signals:
if: (cf.bot_management.score lt 10 and cf.waf.content_scan.has_obj)
then: BLOCK
Roadmap
WAF Content Scanning is new, and Cloudflare has planned several improvements. These include raising the maximum scanned content size, adding a rewrite action to send malicious files to a quarantine server, and delivering richer analytics so you can explore the data without necessarily deploying rules.
