6

I've read about Web Application Firewalls in a MOOC, and the provided example is that the WAF can filter out a request like ?user=<script to avoid potential XSS attacks.

But what if a webpage of the application allows to see a user's profile in a pretty way like view_user?name=... (instead of ID-based)? I could set my name to <script in the register form or so, and then, no one will be able to see my profile, because the page would legitimately be view_user?name=<script and the WAF rejects it?

Such username sounds odd, but it can be an advantage to have a non-accessible profile in some applications: like, in a game where you have to view the player's page [or a town's page or a character's page etc] to attack them, in a forum where you need to get to a user's page to edit/ban them, etc.

In more general terms: can you avoid side-effects of WAF rules that break business-logic? How?

Improve this question
3
  • It doesn't work like that in real world. Name=<script would never work because you view the profile of the person using unique identifier and not the name which is not unique. Regarding avoiding side-effects of WAF, this is done on the design stage of the application. By defining the business flow you write WAF rules specifically for it (every application uses dedicated WAF rules). And then you do testing of these rules to make sure it doesn't break anything. Also, WAF would not allow you to create name as <script> in first place.
    – Aria
    Commented Oct 10, 2017 at 12:14
  • 4
    @Aria I disagree. IMO, OP raises an actual issue with WAFs. They can occasionally be abused to trigger false positives. Also, a WAF might allow a username like <script> in a POST request but reject it in a URL.
    – Arminius
    Commented Oct 10, 2017 at 15:50
  • @Aria Hence my in a pretty way like view_user?name=... instead of ID-based. You can pass the ID still, and rely on it, using only the name as a decoration. Like /view/profile/<script-1234 (lot of websites do so, showing a page's title in the URL along with the real page ID). And so, as @Arminius said, I was actually wondering if WAF can be abused to trigger false positives, what consequences this can lead to and how to deal with these/avoid these.
    – Xenos
    Commented Oct 11, 2017 at 14:57

1 Answer 1

Reset to default
2

In a general sense, WAFs are historically notorious for false positives- issuing alerts on legitimate requests when in non-blocking mode, and for edge case breakage of applications, difficult or impossible to reproduce in non-production environments, when in blocking mode.

As a result, the overall space is evolving away from signature- and granular request-specific alerting- which is really the responsibility of the application- and moving more towards reputation analysis, statistical anomaly detection, and providing pooled intelligence around the behavior of threat actors.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .