How does the argument parsing limit create a vulnerability for WAFs?

Question

Accepted Answer

In the realm of web security, Nginx, a widely adopted web server, possesses a default configuration that limits the number of request arguments it parses to a maximum of 100. This safeguard is intrinsically designed to mitigate denial-of-service (DoS) attacks by preventing servers from being overwhelmed by excessively complex requests. However, this very mechanism introduces a critical vulnerability for Web Application Firewalls (WAFs) that are built upon Nginx.

The core of the issue lies in how these WAFs operate. They function by inspecting incoming requests for malicious patterns. If a request exceeds Nginx's default argument limit of 100, Nginx silently discards any arguments beyond this threshold without signaling an error. Consequently, a WAF relying on Nginx's parsing capabilities will never see these discarded arguments. If a malicious payload, such as a command injection attempt, is strategically placed within these extra arguments, the WAF will be effectively blind to it, as the argument containing the threat is never processed. This was precisely the scenario identified by Mlytics researchers concerning Cloudflare's WAF, which at the time utilized Nginx.

Mlytics' investigation revealed that requests containing more than 100 parameters could bypass Cloudflare's WAF. This bypass occurred because the malicious payloads were embedded within the arguments that Nginx would discard due to its default limit. For instance, a test scenario demonstrated that a request with a single malicious parameter, like <%21–%23cmd, was correctly blocked by Cloudflare's WAF, resulting in a 403 Forbidden response. However, when the same malicious payload was included as the 101st parameter in a request with 100 preceding arguments, Cloudflare's WAF failed to detect and block it, allowing the request to proceed with a 200 OK status.

To address this critical gap, Mlytics implemented a patch on their own platform. This solution operates by intercepting requests before they are fully processed by the underlying Nginx instance and any WAFs. By adding this layer of inspection, Mlytics could identify and block malicious requests that would have otherwise bypassed Cloudflare's WAF due to the argument parsing limitation. Following the implementation of Mlytics' patch, the same test scenario involving over 100 parameters, including the command injection payload, was successfully blocked by Mlytics' platform, returning a 403 Forbidden response. This effectively mitigated the vulnerability for users leveraging Mlytics' services, even though Cloudflare's WAF itself remained unchanged.

Reading history

Hide →

This history is cleared when the page is closed.

How does the argument parsing limit create a vulnerability for WAFs?

Loading

Was this article helpful?

Helpful

Not helpful

Report an issue

10

0

0

Share with friends