Abusing the PHP Query String Parser to Bypass IDS, IPS, and WAF

Re:Abusing the PHP Query String Parser to Bypass IDS, IPS, a... by chx on Monday July 08, 2019 @03:30PM (#20385939)

Hrm... the solution is to keep your PHP codebase up to date...?

[ Parent | on HN ]

Re:Abusing the PHP Query String Parser to Bypass IDS, IPS, a... by JeremyBanks on Monday July 08, 2019 @03:36PM (#20385999)

The solution is to throw out your WAF.

[ Parent | on HN ]

Re:Abusing the PHP Query String Parser to Bypass IDS, IPS, a... by simlevesque on Monday July 08, 2019 @04:08PM (#20386280)

WAF has it's purpose but it's clearly not a silver bullet. Nothing is.

[ Parent | on HN ]

Re:Abusing the PHP Query String Parser to Bypass IDS, IPS, a... by nullwasamistake on Monday July 08, 2019 @05:31PM (#20386961)

WAF is brittle and breaks more than it fixes IMO. It's just regex against URL's in 99% of cases. If you think you need one, you need to fix the app code, there will be more vulnerabilities it doesn't block

[ Parent | on HN ]

Re:Abusing the PHP Query String Parser to Bypass IDS, IPS, a... by simlevesque on Tuesday July 09, 2019 @02:57PM (#20395369)

WAF provides a lot of other things, such as IP based filtering.

[ Parent | on HN ]

Re:Abusing the PHP Query String Parser to Bypass IDS, IPS, a... by DJBunnies on Monday July 08, 2019 @04:49PM (#20386613)

If it's so easily circumvented I wonder if it's worth the costs.

[ Parent | on HN ]

Re:Abusing the PHP Query String Parser to Bypass IDS, IPS, a... by aventrix on Monday July 08, 2019 @03:49PM (#20386117)

Disagree. This just reinforces the point that best security is multi-layered.

[ Parent | on HN ]

Re:Abusing the PHP Query String Parser to Bypass IDS, IPS, a... by tptacek on Monday July 08, 2019 @05:13PM (#20386814)

That's an apology every crappy security add-on has always made. We shouldn't be happy about applying layer after layer of faulty controls, let alone applauding that as some kind of defense-in-depth best practice.

[ Parent | on HN ]

Re:Abusing the PHP Query String Parser to Bypass IDS, IPS, a... by nullwasamistake on Monday July 08, 2019 @05:32PM (#20386966)

WAF are basically all HTTP proxies. If you app has a non-broken HTTP implementation they're useless.

[ Parent | on HN ]

Re:Abusing the PHP Query String Parser to Bypass IDS, IPS, a... by sytringy05 on Monday July 08, 2019 @06:11PM (#20387268)

yup, WAFs, IDS and IPS prevent protocol abuse. Everything else is the development teams problem

[ Parent | on HN ]

Re:Abusing the PHP Query String Parser to Bypass IDS, IPS, a... by westurner on Monday July 08, 2019 @05:14PM (#20386831)

Possible solutions:

(1) Change all underscores in WAF rule URL attribute names to the appropriate non-greedy regex. Though I'm not sure about the regex the article suggests: '.' only matches one character, AFAIU.

(2) Add a config parameter to PHP that turns off the magical url parameter name mangling that no webapp should ever depend on ( and have it default to off because if you rely on this 'feature' you should have to change a setting in php.ini anyway )

[ Parent | on HN ]