3

Problem

Users in my application are being blocked (by the AWS WAF) from uploading files with certain names. In the specific case I am trying to solve, the problematic string is .* System (.*).*.

Background

The block is coming from the PHPHighRiskMethodsVariables_BODY rule that is a default inside AWS-AWSManagedRulesPHPRuleSet. Based on information found in the AWS docs - here - the check looks for PHP injection, and automatically blocks anything it detects.

Current solution

I have tested a fix where I label these requests and block all labeled requests NOT from my whitelisted file uploader. That being said, I am reticent to deploy, as I have no understanding of the risk vector I am exposing the product to.

Help sought

With that information, I am hoping to get some insight as to how much work PHPHighRiskMethodsVariables_BODY is actually doing for me. If it is a big attack vector, it would be foolish to weaken the WAF, and maybe I should instead provide some generic error message of "please try renaming your file". I could also add an additional check to my current solution that only allows problematic requests that have the exact regex pattern I called out in the problem (with even more specificity). That being said, without an understanding of all the banned words, I'll be playing whack-a-mole with the whitelist.

Any help or additional reading would be appreciated!

1 Answer 1

1

Not dangerous at all. That rule is almost as bad as https://thedailywtf.com/articles/Injection_Rejection is. It will block a lot of legitimate things, and unless there's a vulnerability in your application already, it's providing exactly zero security.

1
  • Thank you! This sets me at ease. I've already taken the extra step of stripping all non alphanumeric character for the actual file extraction, so this makes me doubly confident in adding a firewall override. Dec 15, 2023 at 15:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .