Bypassing WAFs with the Phantom $Version Cookie
PortSwigger researcher Zakhar Fedotkin reveals a critical security vulnerability involving HTTP cookie parsing discrepancies that allow attackers to bypass Web Application Firewalls (WAFs). The analysis focuses on the legacy RFC2109 standard, specifically the use of the $Version attribute, which triggers different parsing behaviors in various web frameworks compared to modern browsers. By exploiting these inconsistencies, particularly in Spring Boot and Python-based frameworks like Flask and Django, attackers can inject malicious payloads hidden within quoted strings or use octal escape sequences to evade detection. The article demonstrates how WAFs often fail to detect these obfuscated inputs, enabling potential SQL injection or command injection attacks. For instance, blocked functions like eval() can be disguised using character encoding techniques that WAFs do not properly decode before inspection. This research highlights the dangers of parser divergence between servers and security tools, urging developers and security professionals to account for legacy cookie standards when configuring WAF rules and validating input data to prevent sophisticated evasion techniques.
Wire timeline
Bypassing WAFs with the Phantom $Version Cookie
PortSwigger researcher Zakhar Fedotkin reveals a critical security vulnerability involving HTTP cookie parsing discrepancies that allow attackers to bypass Web Application Firewalls (WAFs). The analysis focuses on the legacy RFC2109 standard, specifically the use of the $Version attribute, which triggers different parsing behaviors in various web frameworks compared to modern browsers. By exploiting these inconsistencies, particularly in Spring Boot and Python-based frameworks like Flask and Django, attackers can inject malicious payloads hidden within quoted strings or use octal escape sequences to evade detection. The article demonstrates how WAFs often fail to detect these obfuscated inputs, enabling potential SQL injection or command injection attacks. For instance, blocked functions like eval() can be disguised using character encoding techniques that WAFs do not properly decode before inspection. This research highlights the dangers of parser divergence between servers and security tools, urging developers and security professionals to account for legacy cookie standards when configuring WAF rules and validating input data to prevent sophisticated evasion techniques.
PortSwigger Research