3 ms·
If the WAF blocks any request containing "{", that would be fairly safe, right? Yes, some attacks could still get through (e.g. a backend that receives request
by Thorrez 5y ago
If the WAF blocks any request containing "{", that would be fairly safe, right?
Yes, some attacks could still get through (e.g. a backend that receives requests base64-encoded), but that's the case generally with WAFs I think.
- simcop2387 5y agoThag would also mean blocking any apis that use json. This would not end well in the short term, or long term.
- Thorrez 5y agoYou could probably write a more advanced check than just "{" that would let most JSON through while still blocking the attack.
- miohtama 5y agoCloudflare did something along these lines: https://blog.cloudflare.com/how-cloudflare-security-responded-to-log4j2-vulnerability/ https://blog.cloudflare.com/how-cloudflare-security-responde...
- PeterisP 5y agoThe devil is in the details. As a random example, you might have a process where all the pre-WAF requests (or explicitly the requests blocked by WAF) get forwarded to a log analysis system that itself uses log4j and is vulnerable, allowing the attacker to gain RCE in your monitoring infrastructure. Also, blocking any request containing "{" is tricky - like, that's so generic that it's time-consuming to verify that it won't break anything, and it's very likely that JSON is used somewhere in that application traffic, so you can't simply do that.
- Thorrez 5y agoYou could also have a log analysis system that displays logs in the browser and has an XSS vulnerability. So that bypass isn't unique to log4j. > JSON You could probably write a more advanced check than just "{" that would let most JSON through while still blocking the attack.