An IIS memory leak allowed the Cloudflare WAF to be bypassed.
How I reproduced a critical IIS 8.0 HTTP.sys memory disclosure and proved that exposed origin IPs could bypass Cloudflare WAF.
A healthcare diagnostics platform was running behind Cloudflare WAF, but its origin IPs were publicly exposed through DNS. The servers were also running unpatched IIS 8.0. I reproduced the critical CVE-2015-1635 HTTP.sys memory-disclosure issue, recovered kernel memory, and proved that direct access to the origin could bypass Cloudflare completely.
The Problem
A healthcare diagnostics provider was running a public ASP.NET platform behind Cloudflare WAF. During initial reconnaissance, I found the origin IPs for the main application and several replica servers exposed through DNS. Anyone who knew those IPs could connect directly to the servers and avoid Cloudflare completely.
The servers were also running IIS 8.0 with several known, unpatched vulnerabilities, making the exposed origins a much bigger concern than a simple configuration issue.
The Findings
The main issue was MS15-034 (CVE-2015-1635), a critical HTTP.sys memory-disclosure vulnerability in IIS 8.0 with a CVSS score of 9.8. I successfully reproduced the issue and recovered kernel memory from the server.
The Test
I safely reproduced the HTTP.sys issue using the Metasploit ms15_034_http_sys_memory_dump module and confirmed that it returned kernel memory on the first attempt.
I preserved two memory-dump files as forensic evidence, enumerated 8 subdomains, and mapped the exposed origins through DNS reconnaissance. To prove the Cloudflare bypass, I sent HTTP requests directly to the origin IPs with curl and confirmed they reached the application without passing through Cloudflare.
I also reviewed TLS configuration with OpenSSL and external scanners, then fingerprinted the IIS version through the /CRL/ application root binding.
The Result
The client received a critical-risk report containing a working proof of concept for the IIS HTTP.sys vulnerability and evidence of the exposed origin infrastructure.
The memory disclosure confirmed that the issue was not simply theoretical: the server was leaking internal information, while its public origin IPs made Cloudflare protection avoidable.
The final report included a prioritised patching roadmap, origin-IP hiding recommendations, and a TLS hardening plan. According to the internal security team, the memory-disclosure evidence was the most useful part because it gave them the concrete proof needed to move their patching request through internal approval.