Proxy / WAF Protections Bypass
Bypass Nginx ACL Rules with Pathname Manipulation
Techniques from this research.
Nginx rule example:
In order to prevent bypasses Nginx performs path normalization before checking it. However, if the backend server performs a different normalization (removing characters that nginx doesn't remove) it might be possible to bypass this defense.
NodeJS - Express
Nginx Version | Node.js Bypass Characters |
1.22.0 |
|
1.21.6 |
|
1.20.2 |
|
1.18.0 |
|
1.16.1 |
|
Flask
Nginx Version | Flask Bypass Characters |
1.22.0 |
|
1.21.6 |
|
1.20.2 |
|
1.18.0 |
|
1.16.1 |
|
Spring Boot
Nginx Version | Spring Boot Bypass Characters |
1.22.0 |
|
1.21.6 |
|
1.20.2 |
|
1.18.0 |
|
1.16.1 |
|
PHP-FPM
Nginx FPM configuration:
Nginx is configured to block access to /admin.php
but it's possible to bypass this by accessing /admin.php/index.php
.
How to prevent
Bypass Mod Security Rules
Path Confusion
In this post is explained that ModSecurity v3 (until 3.0.12), improperly implemented the REQUEST_FILENAME
variable which was supposed to contain the accessed path (until the start of the parameters). This is because it performed an URL decode to get the path.
Therefore, a request like http://example.com/foo%3f';alert(1);foo=
in mod security will suppose that the path is just /foo
because %3f
is transformed into ?
ending the URL path, but actually the path that a server will receive will be /foo%3f';alert(1);foo=
.
The variables REQUEST_BASENAME
and PATH_INFO
were also affected by this bug.
Something similar ocurred in version 2 of Mod Security that allowed to bypass a protection that prevented user accessing files with specific extensions related to backup files (such as .bak
) simply by sending the dot URL encoded in %2e
, for example: https://example.com/backup%2ebak
.
Bypass AWS WAF ACL
Malformed Header
This research mentions that it was possible to bypass AWS WAF rules applied over HTTP headers by sending a "malformed" header that wasn't properly parsed by AWS but it was by the backend server.
For example, sending the following request with a SQL injection in the header X-Query:
It was possible to bypass AWS WAF because it wouldn't understand that the next line is part of the value of the header while the NODEJS server did (this was fixed).
References
Last updated