How did the Nginx Lua limitation affect WAF detection capabilities?

Question

Accepted Answer

Nginx's Lua implementation presents a critical limitation that directly impacts the efficacy of Web Application Firewalls (WAFs) built upon it. Specifically, Nginx's Lua module, by default, restricts the parsing of request arguments to a maximum of 100. Any arguments exceeding this threshold are silently discarded. This mechanism is a built-in safeguard against potential denial-of-service (DoS) attacks, which could otherwise be orchestrated by overwhelming a server with an excessive number of parameters.

This default behavior creates a significant vulnerability for WAFs that rely on Nginx's Lua scripting. If a malicious request is crafted with more than 100 arguments, the harmful payloads embedded within these extra arguments will not be parsed or inspected by the WAF. Consequently, such requests can bypass security checks entirely, leaving the protected application susceptible to attacks that would otherwise be detected and blocked. For instance, Mlytics observed that prior to their intervention, requests containing over 100 parameters could successfully circumvent Cloudflare's WAF.

Mlytics encountered this issue because their platform offers users the flexibility to select their preferred Content Delivery Network (CDN) providers, including Cloudflare, while still providing unified security policy enforcement through their proprietary WAF. When users enabled Cloudflare via Mlytics' Multi-CDN solution, they became exposed to this Nginx Lua argument parsing limitation. Rather than waiting for an external patch, Mlytics developed and implemented a solution on their own platform.

This patch involved creating a mechanism to intercept requests that would have otherwise bypassed Cloudflare's WAF due to the Lua-Nginx vulnerability. Through this proactive measure, Mlytics ensured their users remained protected. Demonstrative tests conducted by Mlytics clearly illustrated the effectiveness of their patch. Before the implementation, a request exceeding the 100-argument limit bypassed Cloudflare's WAF, resulting in a 200 OK response from the server. However, after Mlytics applied their patch, the identical request, even with over 100 parameters, was intercepted and rejected by the Mlytics platform, resulting in a 403 Forbidden response, proving that their system effectively addressed the bypass.

Reading history

Hide →

This history is cleared when the page is closed.

How did the Nginx Lua limitation affect WAF detection capabilities?

Loading

Was this article helpful?

Helpful

Not helpful

Report an issue

10

0

0

Share with friends