5 ms·
Abusing the PHP Query String Parser to Bypass IDS, IPS, and WAF
- chx 7y agoHrm... the solution is to keep your PHP codebase up to date...?
- JeremyBanks 7y agoThe solution is to throw out your WAF.
- aventrix 7y agoDisagree. This just reinforces the point that best security is multi-layered.
- tptacek 7y agoThat's an apology every crappy security add-on has always made. We shouldn't be happy about applying layer after layer of faulty controls, let alone applauding that as some kind of defense-in-depth best practice.
- nullwasamistake 7y agoWAF are basically all HTTP proxies. If you app has a non-broken HTTP implementation they're useless.
- sytringy05 7y agoyup, WAFs, IDS and IPS prevent protocol abuse. Everything else is the development teams problem
- simlevesque 7y agoWAF has it's purpose but it's clearly not a silver bullet. Nothing is.
- DJBunnies 7y agoIf it's so easily circumvented I wonder if it's worth the costs.
- nullwasamistake 7y agoWAF is brittle and breaks more than it fixes IMO. It's just regex against URL's in 99% of cases. If you think you need one, you need to fix the app code, there will be more vulnerabilities it doesn't block
- simlevesque 7y agoWAF provides a lot of other things, such as IP based filtering.
- westurner 7y agoPossible solutions: (1) Change all underscores in WAF rule URL attribute names to the appropriate non-greedy regex. Though I'm not sure about the regex the article suggests: '.' only matches one character, AFAIU. (2) Add a config parameter to PHP that turns off the magical url parameter name mangling that no webapp should ever depend on ( and have it default to off because if you rely on this 'feature' you should have to change a setting in php.ini anyway )
- tptacek 7y agoOr, "why you shouldn't rely on IDS, IPS, and WAF".
- cortesoft 7y agoFor anything?
- tptacek 7y agoI like Signal Science just as a product in general, and have used it to accomplish a variety of security tasks for clients. I am not sold on the core promise of WAF/RASP, where you front an insecure application with a middlebox that resolves security problems for you, and I think I'm squarely in the mainstream of security industry opinion on that.
- glenjamin 7y agoIn a situation where you're saddled with an insecure application you can't touch, I think a WAF can make sense. In the situation I hope many people are in, where they have a production application they own that they can quicky continuously deploy to - what's the WAF for?
- ownagefool 7y agoThere's a concept that you should use several products in highly secure environments. For example, if your input validation is written in PHP, you might want to write another layer in front, i.e. in your reverse proxy layer, using something like https://github.com/nbs-system/naxsi https://github.com/nbs-system/naxsi. The way, neither just a PHP bug nor a lua bug should defeat you. In reality, they're probably written by the same person, and thus it's probably a logic bug that will result in a hack and, assuming a zero sum game in engineering time, I'd probably rather focus on protective monitoring than rewriting the same input validation. But there you go. In much the same way, if you don't really believe you can trust cisco or huawei to protect against their respective governments, then you layer both and hope they keep each other in check.
- cwojno 7y agoSeeing a lot of WAF-hate. Additional rules could fix this. Flame-bait Proposal: Or, "why you shouldn't use PHP" or any other language the silently converts badly-encoded input for you?
- TazeTSchnitzel 7y agoIf you wonder why PHP does this, I think it comes from our old friend register_globals. In the past, query string, request body and cookie values were automatically made into global variables, so they needed to have variable-friendly names.
- meritt 7y agoCorrect, this behavior is well-known and has been around for 20+ years. Leading spaces are removed and additionally other spaces or dots are converted to an underscore. For this reason, many frameworks ignore the default $_GET structure and instead access the raw URI query in $_SERVER['QUERY_STRING'].
- founderling 7y agoNothing is abused, nothing is bypassed. The article makes it sound like IDS/IPS&WAF are intended to do input validation so it fits the applications model of the data. They are not. They are intended to harden the whole stack a little bit against yet undiscovered vulnerabilities. By the same logic, this "article" could claim that it is possible to abuse Pythons strip() function to bypass WAF rules because filtering for the user name "root" will not filter out " root" and many login systems do strip whitespace before processing the input. This applies to any language. Here on HN I can log in as "founderling" or " founderling" just fine. If you want to filter out something in WAF, you 1) have to do it right and 2) do not do it for input validation at all. It has nothing to do with the language if you fail at 1 and or 2.
- _nalply 7y agoIf you do positive validation, you probably won't be affected by this. In other words: check that the id is a string with digits only. Don't search for invalid characters like ASCII NUL or for clever escapes, because there are too many ways of abuse. Use ctype_digit() for numerical ids and stop with a validation error if ctype_digit() does not return TRUE. https://www.php.net/manual/en/function.ctype-digit.php https://www.php.net/manual/en/function.ctype-digit.php For more complicated cases (like an id with lowercase letters and digits) preg_match() can be used, for example: preg_match('/^[a-z0-9]+$/').
- HiddenIncome 7y agoparse_str also does not work the same as the parser generating $_GET because it doesn't replace control characters: https://bugs.php.net/bug.php?id=76255 https://bugs.php.net/bug.php?id=76255