Researchers Detail New Attack Method to Bypass Popular Web Application Firewalls

A new attack process can be utilised to circumvent web application firewalls (WAFs) of a variety of sellers and infiltrate devices, likely enabling attackers to attain obtain to delicate small business and buyer information and facts.

Web application firewalls are a essential line of defense to assist filter, observe, and block HTTP(S) visitors to and from a web application, and safeguard towards attacks this kind of as cross-internet site forgery, cross-site-scripting (XSS), file inclusion, and SQL injection.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

The generic bypass “requires appending JSON syntax to SQL injection payloads that a WAF is unable to parse,” Claroty researcher Noam Moshe explained. “Most WAFs will simply detect SQLi attacks, but prepending JSON to SQL syntax still left the WAF blind to these attacks.”

The industrial and IoT cybersecurity business mentioned its approach correctly worked towards WAFs from sellers like Amazon Web Expert services (AWS), Cloudflare, F5, Imperva, and Palo Alto Networks, all of whom have because unveiled updates to guidance JSON syntax through SQL injection inspection.

With WAFs performing as a security guardrail versus destructive external HTTP(S) targeted visitors, an attacker with capabilities to get previous the barrier can receive initial entry to a target setting for even more write-up-exploitation.

The bypass system devised by Claroty financial institutions on the deficiency of JSON help for WAFs to craft rogue SQL injection payloads that consist of JSON syntax to skirt the protections.

“Attackers applying this novel approach could access a backend database and use more vulnerabilities and exploits to exfiltrate information by way of both direct obtain to the server or above the cloud,” Moshe explained. “This is a risky bypass, specifically as much more companies continue on to migrate far more business and features to the cloud.”

Identified this write-up exciting? Observe us on Twitter  and LinkedIn to read through much more unique articles we submit.