Bypassing WAFs Using Oversized Requests

Source: Black Hills Information Security, Inc.

Author: BHIS

URL: https://www.blackhillsinfosec.com/bypassing-wafs-using-oversized-requests/

Bypassing WAFs Using Oversized Requests

ONE SENTENCE SUMMARY:

Exploiting WAF limitations with oversized request bypass techniques highlights the need for careful security configuration and testing.

MAIN POINTS:

  1. Oversized requests can bypass many web application firewalls, exploiting size limits on request processing.
  2. WAF configuration determines exploitability; some allow bypass by default due to flexible design goals.
  3. Examples given include testing WAFs like Cloudflare, Barracuda, ModSecurity, AWS, Azure, Google, Sucuri, and Fortinet.
  4. Cloudflare’s free tier can be bypassed with requests above 8KB, while higher tiers have larger limits.
  5. Barracuda’s WAF is secure by default, lacking size-based vulnerabilities without manual configuration.
  6. ModSecurity requires settings adjustments from default to secure, as it starts in detection-only mode.
  7. AWS limits WAF inspection to the first 8KB by default for certain services, with options to increase.
  8. Azure’s Application Gateway has a secure “fail closed” design, unlike Azure Front Door, which defaults insecurely.
  9. Google Cloud Armor and Sucuri default to vulnerable configurations, allowing large requests by default limits.
  10. Balancing WAF performance, usability, and security is crucial, with appropriate rule adjustments necessary.

TAKEAWAYS:

  1. Oversized requests exploit WAF limits, necessitating tailored configurations for secure operation.
  2. Cloudflare, AWS, and ModSecurity often need manual rule adjustments to close security gaps.
  3. Azure’s Application Gateway is inherently secure against oversized request bypasses due to its “fail closed” design.
  4. Real-world application behavior should inform WAF configurations to effectively handle scale and security needs.
  5. Testing WAFs for both rule coverage and handling of resource limits is essential for robust protection.