prowler 5.16.1__py3-none-any.whl → 5.17.0__py3-none-any.whl

prowler/providers/cloudflare/services/zone/zone_service.py

@@ -0,0 +1,328 @@
+from typing import Optional
+
+from pydantic import BaseModel, Field
+
+from prowler.lib.logger import logger
+from prowler.providers.cloudflare.lib.service.service import CloudflareService
+from prowler.providers.cloudflare.models import CloudflareAccount
+
+
+class CloudflareRateLimitRule(BaseModel):
+    """Cloudflare rate limiting rule representation."""
+
+    id: str
+    description: Optional[str] = None
+    action: Optional[str] = None
+    enabled: bool = True
+    expression: Optional[str] = None
+
+
+class Zone(CloudflareService):
+    """Retrieve Cloudflare zones with security-relevant settings."""
+
+    def __init__(self, provider):
+        super().__init__(__class__.__name__, provider)
+        self.zones: dict[str, "CloudflareZone"] = {}
+        self._list_zones()
+        self._get_zones_settings()
+        self._get_zones_dnssec()
+        self._get_zones_universal_ssl()
+        self._get_zones_rate_limit_rules()
+        self._get_zones_bot_management()
+
+    def _list_zones(self) -> None:
+        """List all Cloudflare zones with their basic information."""
+        logger.info("Zone - Listing zones...")
+        audited_accounts = self.provider.identity.audited_accounts
+        filter_zones = self.provider.filter_zones
+        seen_zone_ids: set[str] = set()
+
+        try:
+            for zone in self.client.zones.list():
+                zone_id = getattr(zone, "id", None)
+                # Prevent infinite loop - skip if we've seen this zone
+                if zone_id in seen_zone_ids:
+                    break
+                seen_zone_ids.add(zone_id)
+
+                zone_account = getattr(zone, "account", None)
+                account_id = getattr(zone_account, "id", None) if zone_account else None
+
+                # Filter by audited accounts
+                if audited_accounts and account_id not in audited_accounts:
+                    continue
+
+                zone_name = getattr(zone, "name", None)
+
+                # Apply zone filter if specified via --region
+                if (
+                    filter_zones
+                    and zone_id not in filter_zones
+                    and zone_name not in filter_zones
+                ):
+                    continue
+
+                zone_plan = getattr(zone, "plan", None)
+                self.zones[zone_id] = CloudflareZone(
+                    id=zone_id,
+                    name=zone_name,
+                    status=getattr(zone, "status", None),
+                    paused=getattr(zone, "paused", False),
+                    account=(
+                        CloudflareAccount(
+                            id=account_id,
+                            name=(
+                                getattr(zone_account, "name", "")
+                                if zone_account
+                                else ""
+                            ),
+                            type=(
+                                getattr(zone_account, "type", None)
+                                if zone_account
+                                else None
+                            ),
+                        )
+                        if zone_account
+                        else None
+                    ),
+                    plan=getattr(zone_plan, "name", None) if zone_plan else None,
+                )
+
+            if not self.zones:
+                logger.warning(
+                    "No Cloudflare zones discovered with current credentials."
+                )
+        except Exception as error:
+            logger.error(
+                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
+    def _get_zones_settings(self) -> None:
+        """Get settings for all zones."""
+        logger.info("Zone - Getting zone settings...")
+        for zone in self.zones.values():
+            try:
+                zone.settings = self._get_zone_settings(zone.id)
+            except Exception as error:
+                logger.error(
+                    f"{zone.id} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+
+    def _get_zones_dnssec(self) -> None:
+        """Get DNSSEC status for all zones."""
+        logger.info("Zone - Getting DNSSEC status...")
+        for zone in self.zones.values():
+            try:
+                dnssec = self.client.dns.dnssec.get(zone_id=zone.id)
+                zone.dnssec_status = getattr(dnssec, "status", None)
+            except Exception as error:
+                logger.error(
+                    f"{zone.id} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+
+    def _get_zones_universal_ssl(self) -> None:
+        """Get Universal SSL settings for all zones."""
+        logger.info("Zones - Getting Universal SSL settings...")
+        for zone in self.zones.values():
+            try:
+                universal_ssl = self.client.ssl.universal.settings.get(zone_id=zone.id)
+                zone.settings.universal_ssl_enabled = getattr(
+                    universal_ssl, "enabled", False
+                )
+            except Exception as error:
+                logger.error(
+                    f"{zone.id} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+
+    def _get_zones_rate_limit_rules(self) -> None:
+        """Get rate limiting rules for all zones."""
+        logger.info("Zone - Getting rate limit rules...")
+        for zone in self.zones.values():
+            try:
+                seen_ruleset_ids: set[str] = set()
+                for ruleset in self.client.rulesets.list(zone_id=zone.id):
+                    ruleset_id = getattr(ruleset, "id", "")
+                    if ruleset_id in seen_ruleset_ids:
+                        break
+                    seen_ruleset_ids.add(ruleset_id)
+
+                    phase = getattr(ruleset, "phase", "")
+                    if phase == "http_ratelimit":
+                        try:
+                            ruleset_detail = self.client.rulesets.get(
+                                ruleset_id=ruleset_id, zone_id=zone.id
+                            )
+                            rules = getattr(ruleset_detail, "rules", []) or []
+                            seen_rule_ids: set[str] = set()
+                            for rule in rules:
+                                rule_id = getattr(rule, "id", "")
+                                if rule_id in seen_rule_ids:
+                                    break
+                                seen_rule_ids.add(rule_id)
+                                zone.rate_limit_rules.append(
+                                    CloudflareRateLimitRule(
+                                        id=rule_id,
+                                        description=getattr(rule, "description", None),
+                                        action=getattr(rule, "action", None),
+                                        enabled=getattr(rule, "enabled", True),
+                                        expression=getattr(rule, "expression", None),
+                                    )
+                                )
+                        except Exception as error:
+                            logger.debug(
+                                f"{zone.id} ruleset {ruleset_id} -- {error.__class__.__name__}: {error}"
+                            )
+            except Exception as error:
+                logger.error(
+                    f"{zone.id} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+
+    def _get_zones_bot_management(self) -> None:
+        """Get Bot Management settings for all zones."""
+        logger.info("Zone - Getting Bot Management settings...")
+        for zone in self.zones.values():
+            try:
+                bot_management = self.client.bot_management.get(zone_id=zone.id)
+                zone.settings.bot_fight_mode_enabled = getattr(
+                    bot_management, "fight_mode", False
+                )
+            except Exception as error:
+                logger.error(
+                    f"{zone.id} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+
+    def _get_zone_setting(self, zone_id: str, setting_id: str):
+        """Get a single zone setting by ID."""
+        try:
+            result = self.client.zones.settings.get(
+                setting_id=setting_id, zone_id=zone_id
+            )
+            return getattr(result, "value", None)
+        except Exception:
+            return None
+
+    def _get_zone_settings(self, zone_id: str) -> "CloudflareZoneSettings":
+        """Get all settings for a zone."""
+        settings = {
+            setting_id: self._get_zone_setting(zone_id, setting_id)
+            for setting_id in [
+                "always_use_https",
+                "min_tls_version",
+                "ssl",
+                "tls_1_3",
+                "automatic_https_rewrites",
+                "security_header",
+                "waf",
+                "security_level",
+                "browser_check",
+                "challenge_ttl",
+                "ip_geolocation",
+                "email_obfuscation",
+                "server_side_exclude",
+                "hotlink_protection",
+                "development_mode",
+                "always_online",
+            ]
+        }
+
+        return CloudflareZoneSettings(
+            always_use_https=settings.get("always_use_https"),
+            min_tls_version=str(settings.get("min_tls_version") or ""),
+            ssl_encryption_mode=settings.get("ssl"),
+            tls_1_3=settings.get("tls_1_3"),
+            automatic_https_rewrites=settings.get("automatic_https_rewrites"),
+            strict_transport_security=self._get_strict_transport_security(
+                settings.get("security_header")
+            ),
+            waf=settings.get("waf"),
+            security_level=settings.get("security_level"),
+            browser_check=settings.get("browser_check"),
+            challenge_ttl=settings.get("challenge_ttl") or 0,
+            ip_geolocation=settings.get("ip_geolocation"),
+            email_obfuscation=settings.get("email_obfuscation"),
+            server_side_exclude=settings.get("server_side_exclude"),
+            hotlink_protection=settings.get("hotlink_protection"),
+            development_mode=settings.get("development_mode"),
+            always_online=settings.get("always_online"),
+        )
+
+    def _get_strict_transport_security(
+        self, security_header
+    ) -> "StrictTransportSecurity":
+        """Parse HSTS settings from security_header."""
+        if hasattr(security_header, "strict_transport_security"):
+            sts = security_header.strict_transport_security
+            sts_data = {
+                "enabled": getattr(sts, "enabled", False),
+                "max_age": getattr(sts, "max_age", 0),
+                "include_subdomains": getattr(sts, "include_subdomains", False),
+                "preload": getattr(sts, "preload", False),
+                "nosniff": getattr(sts, "nosniff", False),
+            }
+        elif isinstance(security_header, dict):
+            sts_data = security_header.get("strict_transport_security", {})
+        else:
+            sts_data = {}
+
+        return StrictTransportSecurity(
+            enabled=sts_data.get("enabled", False),
+            max_age=sts_data.get("max_age", 0),
+            include_subdomains=sts_data.get("include_subdomains", False),
+            preload=sts_data.get("preload", False),
+            nosniff=sts_data.get("nosniff", False),
+        )
+
+
+class StrictTransportSecurity(BaseModel):
+    """HTTP Strict Transport Security (HSTS) settings."""
+
+    enabled: bool = False
+    max_age: int = 0
+    include_subdomains: bool = False
+    preload: bool = False
+    nosniff: bool = False
+
+
+class CloudflareZoneSettings(BaseModel):
+    """Selected Cloudflare zone security settings."""
+
+    # TLS/SSL settings
+    always_use_https: Optional[str] = None
+    min_tls_version: Optional[str] = None
+    ssl_encryption_mode: Optional[str] = None
+    tls_1_3: Optional[str] = None
+    automatic_https_rewrites: Optional[str] = None
+    universal_ssl_enabled: bool = False
+    # HSTS settings
+    strict_transport_security: StrictTransportSecurity = Field(
+        default_factory=StrictTransportSecurity
+    )
+    # Security settings
+    waf: Optional[str] = None
+    security_level: Optional[str] = None
+    browser_check: Optional[str] = None
+    challenge_ttl: Optional[int] = None
+    ip_geolocation: Optional[str] = None
+    # Scrape Shield settings
+    email_obfuscation: Optional[str] = None
+    server_side_exclude: Optional[str] = None
+    hotlink_protection: Optional[str] = None
+    # Zone state
+    development_mode: Optional[str] = None
+    always_online: Optional[str] = None
+    # Bot management
+    bot_fight_mode_enabled: bool = False
+
+
+class CloudflareZone(BaseModel):
+    """Cloudflare zone representation used across services."""
+
+    id: str
+    name: str
+    status: Optional[str] = None
+    paused: bool = False
+    account: Optional[CloudflareAccount] = None
+    plan: Optional[str] = None
+    settings: CloudflareZoneSettings = Field(default_factory=CloudflareZoneSettings)
+    dnssec_status: Optional[str] = None
+    rate_limit_rules: list[CloudflareRateLimitRule] = Field(default_factory=list)

prowler/providers/cloudflare/services/zone/zone_ssl_strict/zone_ssl_strict.metadata.json

@@ -0,0 +1,36 @@
+{
+  "Provider": "cloudflare",
+  "CheckID": "zone_ssl_strict",
+  "CheckTitle": "SSL/TLS encryption mode is set to Full (Strict)",
+  "CheckType": [],
+  "ServiceName": "zone",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "Zone",
+  "ResourceGroup": "network",
+  "Description": "**Cloudflare zones** are assessed for **SSL/TLS encryption mode** by checking if the mode is set to `Full (Strict)` to ensure **end-to-end encryption** with certificate validation.",
+  "Risk": "Without **strict SSL mode**, traffic between Cloudflare and origin may use unvalidated or unencrypted connections.\n- **Confidentiality**: sensitive data can be intercepted in transit via man-in-the-middle attacks\n- **Integrity**: responses can be modified without detection between Cloudflare and origin\n- **Compliance**: may violate PCI-DSS, HIPAA, and other regulatory requirements for encrypted transport",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes/"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Log in to the Cloudflare dashboard and select your account and domain\n2. Go to SSL/TLS > Overview\n3. Under SSL/TLS encryption mode, select Full (strict)\n4. Ensure your origin server has a valid SSL certificate installed (Cloudflare Origin CA or publicly trusted CA)",
+      "Terraform": "```hcl\n# Set SSL/TLS mode to Full (Strict) for end-to-end encryption\nresource \"cloudflare_zone_setting\" \"ssl\" {\n  zone_id    = \"<ZONE_ID>\"\n  setting_id = \"ssl\"\n  value      = \"strict\" # Critical: ensures certificate validation between Cloudflare and origin\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Configure **SSL/TLS mode** to `Full (Strict)` and install a valid certificate on your origin server.\n- Use **Cloudflare Origin CA certificates** for seamless integration\n- Ensure origin server presents a valid certificate matching your domain\n- Enable **Authenticated Origin Pulls** for additional security",
+      "Url": "https://hub.prowler.com/checks/cloudflare/zone_ssl_strict"
+    }
+  },
+  "Categories": [
+    "encryption"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/cloudflare/services/zone/zone_ssl_strict/zone_ssl_strict.py

@@ -0,0 +1,42 @@
+from prowler.lib.check.models import Check, CheckReportCloudflare
+from prowler.providers.cloudflare.services.zone.zone_client import zone_client
+
+
+class zone_ssl_strict(Check):
+    """Ensure that SSL/TLS encryption mode is set to Full (Strict) for Cloudflare zones.
+
+    The SSL/TLS encryption mode determines how Cloudflare connects to the origin
+    server. In 'strict' mode, Cloudflare validates the origin
+    server's SSL certificate, ensuring end-to-end encryption with certificate
+    verification. Lower modes (off, flexible, full) are vulnerable to
+    man-in-the-middle attacks between Cloudflare and the origin.
+    """
+
+    def execute(self) -> list[CheckReportCloudflare]:
+        """Execute the SSL strict mode check.
+
+        Iterates through all Cloudflare zones and verifies that the SSL/TLS
+        encryption mode is set to 'strict'. This mode
+        requires a valid SSL certificate on the origin server and provides
+        full end-to-end encryption with certificate validation.
+
+        Returns:
+            A list of CheckReportCloudflare objects with PASS status if
+            SSL mode is 'strict', or FAIL status if using
+            less secure modes like 'off', 'flexible', or 'full'.
+        """
+        findings = []
+        for zone in zone_client.zones.values():
+            report = CheckReportCloudflare(
+                metadata=self.metadata(),
+                resource=zone,
+            )
+            ssl_mode = (zone.settings.ssl_encryption_mode or "").lower()
+            if ssl_mode == "strict":
+                report.status = "PASS"
+                report.status_extended = f"SSL/TLS encryption mode is set to Full (Strict) for zone {zone.name}."
+            else:
+                report.status = "FAIL"
+                report.status_extended = f"SSL/TLS encryption mode is set to {ssl_mode.capitalize()} for zone {zone.name}, which is not Full (Strict)."
+            findings.append(report)
+        return findings

prowler/providers/cloudflare/services/zone/zone_tls_1_3_enabled/zone_tls_1_3_enabled.metadata.json

@@ -0,0 +1,36 @@
+{
+  "Provider": "cloudflare",
+  "CheckID": "zone_tls_1_3_enabled",
+  "CheckTitle": "TLS 1.3 is enabled",
+  "CheckType": [],
+  "ServiceName": "zone",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "Zone",
+  "ResourceGroup": "network",
+  "Description": "**Cloudflare zones** are assessed for **TLS 1.3** configuration by checking if it is enabled to benefit from **improved security** through simplified cipher suites and **faster handshakes** with zero round-trip time resumption.",
+  "Risk": "Without **TLS 1.3**, connections use older TLS versions with less secure characteristics.\n- **Confidentiality**: legacy TLS versions have more complex cipher negotiations that may expose weaknesses\n- **Integrity**: older protocols lack protection against downgrade attacks that TLS 1.3 provides\n- **Performance**: slower handshakes impact user experience and increase latency",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://developers.cloudflare.com/ssl/edge-certificates/additional-options/tls-13/"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Log in to the Cloudflare dashboard and select your account and domain\n2. Go to SSL/TLS > Edge Certificates\n3. Scroll to TLS 1.3\n4. Toggle the setting to On\n5. Verify that your clients support TLS 1.3 (all modern browsers do)",
+      "Terraform": "```hcl\n# Enable TLS 1.3 for improved security and performance\nresource \"cloudflare_zone_settings_override\" \"tls_settings\" {\n  zone_id = \"<ZONE_ID>\"\n  settings {\n    tls_1_3 = \"on\" # Critical: enables most secure TLS version with faster handshakes\n  }\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Enable **TLS 1.3** to provide the most secure and efficient TLS connections.\n- All modern browsers support TLS 1.3 ensuring broad compatibility\n- TLS 1.3 removes obsolete cryptographic algorithms\n- Zero round-trip time (0-RTT) resumption improves performance\n- Combine with minimum TLS version set to 1.2 or higher",
+      "Url": "https://hub.prowler.com/checks/cloudflare/zone_tls_1_3_enabled"
+    }
+  },
+  "Categories": [
+    "encryption"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "TLS 1.3 is enabled by default on Cloudflare but should be verified. It provides security improvements and performance benefits through simplified handshakes."
+}

prowler/providers/cloudflare/services/zone/zone_tls_1_3_enabled/zone_tls_1_3_enabled.py

@@ -0,0 +1,39 @@
+from prowler.lib.check.models import Check, CheckReportCloudflare
+from prowler.providers.cloudflare.services.zone.zone_client import zone_client
+
+
+class zone_tls_1_3_enabled(Check):
+    """Ensure that TLS 1.3 is enabled for Cloudflare zones.
+
+    TLS 1.3 provides improved security through simplified cipher suites and
+    faster handshakes with zero round-trip time (0-RTT) resumption. It removes
+    outdated cryptographic algorithms, reduces handshake latency, and provides
+    better forward secrecy compared to previous TLS versions.
+    """
+
+    def execute(self) -> list[CheckReportCloudflare]:
+        """Execute the TLS 1.3 enabled check.
+
+        Iterates through all Cloudflare zones and verifies that TLS 1.3 is
+        enabled. The check accepts both "on" (standard TLS 1.3) and "zrt"
+        (TLS 1.3 with 0-RTT) as valid enabled states.
+
+        Returns:
+            A list of CheckReportCloudflare objects with PASS status if TLS 1.3
+            is enabled, or FAIL status if it is disabled for the zone.
+        """
+        findings = []
+        for zone in zone_client.zones.values():
+            report = CheckReportCloudflare(
+                metadata=self.metadata(),
+                resource=zone,
+            )
+            tls_1_3 = (zone.settings.tls_1_3 or "").lower()
+            if tls_1_3 in ["on", "zrt"]:
+                report.status = "PASS"
+                report.status_extended = f"TLS 1.3 is enabled for zone {zone.name}."
+            else:
+                report.status = "FAIL"
+                report.status_extended = f"TLS 1.3 is not enabled for zone {zone.name}."
+            findings.append(report)
+        return findings

prowler/providers/cloudflare/services/zone/zone_universal_ssl_enabled/zone_universal_ssl_enabled.metadata.json

@@ -0,0 +1,36 @@
+{
+  "Provider": "cloudflare",
+  "CheckID": "zone_universal_ssl_enabled",
+  "CheckTitle": "Universal SSL is enabled",
+  "CheckType": [],
+  "ServiceName": "zone",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "Zone",
+  "ResourceGroup": "network",
+  "Description": "**Cloudflare zones** are assessed for **Universal SSL** configuration by checking if it is enabled to provide **free SSL/TLS certificates** for the domain and its subdomains, enabling secure HTTPS connections.",
+  "Risk": "Without **Universal SSL**, visitors cannot establish HTTPS connections to your site.\n- **Confidentiality**: all traffic is unencrypted and vulnerable to interception and eavesdropping\n- **Integrity**: HTTP responses can be modified in transit by attackers (content injection, malware)\n- **Trust**: browsers display security warnings degrading user trust and experience",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://developers.cloudflare.com/ssl/edge-certificates/universal-ssl/"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Log in to the Cloudflare dashboard and select your account and domain\n2. Go to SSL/TLS > Edge Certificates\n3. Scroll to Universal SSL\n4. Ensure the status shows Active\n5. If disabled, click Enable Universal SSL\n6. Wait for certificate issuance (typically within 24 hours for new domains)",
+      "Terraform": "```hcl\n# Note: Universal SSL is enabled by default on Cloudflare\n# To explicitly manage SSL settings, use zone_settings_override\nresource \"cloudflare_zone_settings_override\" \"ssl_settings\" {\n  zone_id = \"<ZONE_ID>\"\n  settings {\n    ssl = \"full\" # Critical: enables SSL/TLS encryption\n  }\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Enable **Universal SSL** to provide HTTPS capability for your domain.\n- Universal SSL is the foundation for transport security\n- Required before implementing HSTS or other HTTPS-dependent features\n- Cloudflare automatically renews certificates before expiration\n- Consider upgrading to Advanced Certificate Manager for additional control",
+      "Url": "https://hub.prowler.com/checks/cloudflare/zone_universal_ssl_enabled"
+    }
+  },
+  "Categories": [
+    "encryption"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Universal SSL is enabled by default for all Cloudflare zones. If it was previously disabled, re-enabling may take up to 24 hours for certificate issuance."
+}

prowler/providers/cloudflare/services/zone/zone_universal_ssl_enabled/zone_universal_ssl_enabled.py

@@ -0,0 +1,42 @@
+from prowler.lib.check.models import Check, CheckReportCloudflare
+from prowler.providers.cloudflare.services.zone.zone_client import zone_client
+
+
+class zone_universal_ssl_enabled(Check):
+    """Ensure that Universal SSL is enabled for Cloudflare zones.
+
+    Universal SSL provides free SSL/TLS certificates for the domain and its
+    subdomains, enabling secure HTTPS connections without requiring manual
+    certificate management. This feature automatically provisions and renews
+    certificates, ensuring continuous protection for web traffic.
+    """
+
+    def execute(self) -> list[CheckReportCloudflare]:
+        """Execute the Universal SSL enabled check.
+
+        Iterates through all Cloudflare zones and verifies that Universal SSL
+        is enabled. Universal SSL provides automatic certificate provisioning
+        and management for the zone and its subdomains.
+
+        Returns:
+            A list of CheckReportCloudflare objects with PASS status if Universal
+            SSL is enabled, or FAIL status if it is disabled for the zone.
+        """
+        findings = []
+        for zone in zone_client.zones.values():
+            report = CheckReportCloudflare(
+                metadata=self.metadata(),
+                resource=zone,
+            )
+            if zone.settings.universal_ssl_enabled:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Universal SSL is enabled for zone {zone.name}."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Universal SSL is not enabled for zone {zone.name}."
+                )
+            findings.append(report)
+        return findings

prowler/providers/cloudflare/services/zone/zone_waf_enabled/zone_waf_enabled.metadata.json

@@ -0,0 +1,36 @@
+{
+  "Provider": "cloudflare",
+  "CheckID": "zone_waf_enabled",
+  "CheckTitle": "WAF is enabled",
+  "CheckType": [],
+  "ServiceName": "zone",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "Zone",
+  "ResourceGroup": "network",
+  "Description": "**Cloudflare zones** are assessed for **Web Application Firewall (WAF)** configuration by checking if it is enabled to protect against common web vulnerabilities including **SQL injection**, **XSS**, and **OWASP Top 10** threats.",
+  "Risk": "Without **WAF**, web applications are exposed to common attack vectors.\n- **Confidentiality**: SQL injection attacks can exfiltrate sensitive database contents\n- **Integrity**: XSS attacks can modify page content and steal session tokens\n- **Availability**: application-layer attacks can cause service disruption",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://developers.cloudflare.com/waf/"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Log in to the Cloudflare dashboard and select your account and domain\n2. Go to Security > WAF\n3. Enable managed rulesets (OWASP, Cloudflare Managed Ruleset)\n4. Configure custom rules based on your application's specific threat model\n5. Monitor WAF analytics to tune rules and reduce false positives",
+      "Terraform": "```hcl\n# Enable WAF managed rulesets for comprehensive protection\nresource \"cloudflare_ruleset\" \"waf_managed\" {\n  zone_id = \"<ZONE_ID>\"\n  name    = \"WAF Managed Rules\"\n  kind    = \"zone\"\n  phase   = \"http_request_firewall_managed\"\n  rules {\n    action = \"execute\"\n    action_parameters {\n      id = \"efb7b8c949ac4650a09736fc376e9aee\" # Cloudflare Managed Ruleset\n    }\n    expression  = \"true\"\n    description = \"Execute Cloudflare Managed Ruleset\"\n  }\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Enable **WAF** as a critical layer of defense for web applications.\n- Deploy managed rulesets for protection against OWASP Top 10 vulnerabilities\n- Create custom rules based on your application's specific threat model\n- Monitor WAF analytics to tune rules and reduce false positives\n- Combine with rate limiting and bot protection for comprehensive security",
+      "Url": "https://hub.prowler.com/checks/cloudflare/zone_waf_enabled"
+    }
+  },
+  "Categories": [
+    "vulnerabilities"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "WAF is available on Pro, Business, and Enterprise plans. Configure managed rulesets and create custom rules to match your application's specific security requirements."
+}

prowler/providers/cloudflare/services/zone/zone_waf_enabled/zone_waf_enabled.py

@@ -0,0 +1,40 @@
+from prowler.lib.check.models import Check, CheckReportCloudflare
+from prowler.providers.cloudflare.services.zone.zone_client import zone_client
+
+
+class zone_waf_enabled(Check):
+    """Ensure that WAF is enabled for Cloudflare zones.
+
+    The Web Application Firewall (WAF) protects against common web vulnerabilities
+    including SQL injection, cross-site scripting (XSS), and other OWASP Top 10
+    threats. When enabled, it inspects HTTP requests and blocks malicious traffic
+    before it reaches the origin server.
+    """
+
+    def execute(self) -> list[CheckReportCloudflare]:
+        """Execute the WAF enabled check.
+
+        Iterates through all Cloudflare zones and verifies that the Web Application
+        Firewall is enabled. The WAF provides essential protection against common
+        web application attacks.
+
+        Returns:
+            A list of CheckReportCloudflare objects with PASS status if WAF is
+            enabled, or FAIL status if it is disabled for the zone.
+        """
+        findings = []
+        for zone in zone_client.zones.values():
+            report = CheckReportCloudflare(
+                metadata=self.metadata(),
+                resource=zone,
+            )
+            waf_setting = (zone.settings.waf or "").lower()
+
+            if waf_setting == "on":
+                report.status = "PASS"
+                report.status_extended = f"WAF is enabled for zone {zone.name}."
+            else:
+                report.status = "FAIL"
+                report.status_extended = f"WAF is not enabled for zone {zone.name}."
+            findings.append(report)
+        return findings