Summary
Azure Web Application Firewall (WAF) with OWASP 3.2 managed rule set and below was
vulnerable to command injection bypass using globbing patterns (incorporating the
wildcard "?" in command syntax). For example, while attempting access to "/etc/passwd"
would be blocked, a command targeting "/et?/passwo?d" would be allowed.
Affected Services
Azure WAF
Remediation
None required
Tracked CVEs
No tracked CVEs
References
https://medium.com/secjuice/waf-evasion-techniques-718026d693d8https://medium.com/bugbountywriteup/module-1-introduction-pentesting-bypassing-cloud-waf-fun-profit-75f315951aa8https://twitter.com/justm0rph3u5/status/1542943538857799680
Contributed by https://github.com/justmorpheus
Disclosure Date
Thu, Jun 24th, 2021
Exploitablity Period
until July 16th, 2021
Known ITW Exploitation
-
Detection Methods
-
Piercing Index Rating
-
Discovered by
Divyanshu Shukla
