rWeb application firewall is prone to multiple evasion attacks

Antecedentes

rWeb is a web application firewall from DenyAll, used to protect web applications against common attacks. It combines whitelists, which are difficult to configure and maintain, and pattern blacklists, of which only the default is used in most installations.

Description

There are at least two ways to bypass rWeb controls: incorrect filtering of double encoding in some HTTP protocol parameters, and decoding POST fields only once, which allows bypassing checks with double encoding. Furthermore, if specific regular expressions are not designed, the default filter set is insufficient.

Business impact

Web code always has security flaws, which is why it is important to have a web application firewall. The various attacks that can be carried out by exploiting these vulnerabilities have a high impact.

Affected systems

rWeb up to version 3.5-2816.

Solución

Develop custom regular expressions that implement protection against double encoding, which the firewall does not apply by default.

Calendario de divulgación

References

The information contained within this advisory is supplied 'as-is' with no warranties or guarantees of fitness for use or otherwise. Internet Security Auditors accepts no responsibility for any damage caused by the use or misuse of this information.