Consultants have developed a way to bypass internet software firewalls (WAFs) from a number of vendorsSecurity Affairs

Claroty researchers have developed a way to bypass internet software firewalls (WAFs) from a number of distributors.

Researchers from industrial cybersecurity and IoT agency Claroty have developed an assault approach to bypass internet software firewalls (WAFs) from a number of industry-leading distributors.

The approach was found throughout impartial analysis on Cambium Networks’ wi-fi machine administration platform.

Researchers found a Cambium SQL injection vulnerability which they used to exfiltrate person classes, SSH keys, password hashes, tokens, and verification codes.

Consultants identified that they had been in a position to exploit the SQL injection vulnerability in opposition to the on-premises model, whereas hacking makes an attempt in opposition to the cloud model had been blocked by Amazon Net Providers (AWS) WAF.

Then the consultants began researching methods to bypass the AWS WAF.

Researchers discovered that including JSON syntax to SQL injection payloads bypasses the WAF as it’s unable to parse it.

“Utilizing the JSON syntax, it’s doable to create new SQLi payloads. These payloads, since they don’t seem to be generally recognized, could possibly be used to fly beneath the radar and bypass many safety instruments. reads the report revealed by Claroty. “Utilizing the syntax of various database engines, we had been in a position to compile the next listing of true SQL statements:

• PostgreSQL: ‘{“b”:2}’::jsonb <@ '{“a”:1, “b”:2}'::jsonb Is the JSON on the left contained within the JSON on the precise? True.
• SQLite: ‘{“a”:2,”c”:[4,5,{“f”:7}]}’ -> ‘$.c[2].f’ = 7 Is the worth extracted from this JSON equal to 7? True.
• MySQL: JSON_EXTRACT(‘{“id”: 14, “title”: “Aztalan”}’, ‘$.title’) = ‘Aztalan’ Is the worth extracted from this JSON equal to ‘Aztalan’? True.”

Claroty researchers used the JSON ‘@<' operator to throw the WAF right into a loop and ship malicious SQLi payloads.

Researchers confirm that the bypass assault approach additionally labored in opposition to firewalls from different distributors, together with Cloudflare, F5, Imperva, and Palo Alto Networks.

“We found that WAFs from main distributors didn’t assist JSON syntax of their SQL injection inspection course of, permitting us so as to add JSON syntax to an SQL assertion that blinded a WAF to malicious code. ” concludes the report.

Observe me on Twitter: @securityaffairs and Fb and Mastodon