As part of a CI/CD pipeline, I'm trying to push a Docker image to a private registry that is behind Cloudflare WAF. Certain push attempts go fine, but for one specific image, I'm getting blocked by Cloudflare.
The details of the block are:
- Rule ID: 100515B
- Rule Message: Log4j Body
- Method: PATCH
- Path: /v2/teamname/imagename/blobs/uploads/8b9....
The command triggering this is: docker push myrepo.com/teamname/imagename --all-tags
As I understand it, Cloudflare recognizes the PATCH operation that Docker executes as containing some body that looks like it is trying to exploit the Log4j vulnerability. However, this is a legitimate call. And as I said, a previous docker push command (for another image, but in the same CI/CD pipeline) didn't get blocked.
I first though it might be the content of the image, but now I believe it must be in the body of the HTTP request. I can't really find anything online on the combination of Docker, Cloudflare and the Log4j vulnerability.
I'm wondering if anyone has seen this or knows how I can further troubleshoot this.