Imperva SecureSphere WAF 11.5 Bypass

2018.09.14
Credit: Damien Cabrie
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

Hello everyone, Can I have your opinion about this bug below please ? # Exploit Title: Policy Bypass on Imperva SecureSphere Web Application Firewall # Date: 08/05/2018 # Author: Damien CabriA(c) # Contact: https://twitter.com/nawhack # Vendor Homepage: http://www.imperva.com # Version: Imperva SecureSphere WAF 11.5 in all deployment options # Tested on: Imperva SecureSphere WAF 11.5.0.95_0 (bridge and reverse proxy mode) # Class: Policy Bypass [VULNERABILITY DETAILS] The Imperva WAF provides solutions to protect websites against attacks (SQL injections, cross site scripting, illegal resource access). The protect is base with policies building from Signatures (network, generic attack, known web application vulnerabilities), Application profiling and Threatradar Reputation Service. There is a bug in the Web Correlation Policy engine which protect against SQLi and XSS. The WAF is not able to detect malicious SQLi or XSS content in the body of POST requests without the "Content-Type" header. An attacker can easily craft a POST request method without the Content-Type header to bypass firewall protections. Applications protected by the WAF could be compromised with this bug. [REMEDIATION] If possible, block POST requests without Content-Type header. [DISCLOSURE TIME-LINE] * 08/05/2018 - Initial vendor contact. * 27/06/2018 - Imperva confirmed the issue. Fix targeted for Q4 2018. * 12/07/2018 - Ticket closed. * 18/08/2018 - Public disclosure. Regards


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top