Universal media server firewall bypass Patch#

For URLs this should be URL encoded (%3c %3e %22 etc).

Using HTML for example all HTML metacharacters, including ” ‘ and =, should be replaced with the corresponding HTML entities (< > etc).

Not identifying the correct encoding type can lead to vulnerabilities persisting in an application or possibly introducing other vulnerabilities. Knowledge of how this data is handled by the server language is key, at the time where this input is copied into the application responses it should be output encoded in the correct context such as HTML, URL, JavaScript, and CSS. For example, if an integer is expected then the user input should be converted to an integer and not stored as a string. At the server language level, the user input should be converted to the correct data type. The output encoding should depend on the context in which the untrusted input is used. It is recommended that all user input be output encoded at any point where it is copied into application responses.

Universal media server firewall bypass Patch#

In the case of a new vulnerability is discovered on your site, before a patch can be installed it may be quicker for a ruleset to be added to the WAF to temporarily block this particular payload.

WAF’s offer many types of protection, such as protection against known attacks or vulnerabilities based on blacklists. A motivated attacker will spend as much time as they need to exploit these types of vulnerabilities. Web-application firewalls may not fully protect your sites from these types of attacks. The WAF was triggered when “javascript” followed by “:” was injected into the href attribute.īelow are a few of the attempts made to bypass this WAF ruleset:

Performing basic tests for XSS such as injecting alert(1) triggered the WAF.Įxamples below show that the WordFence WAF is protecting the application against basic XSS payloads.Īfter trying multiple payloads, it was noted that it was possible to inject an anchor tag including the href attribute. Now that we have our injection point, we now need to find a payload that will not trigger the WAF. By using injecting basic HTML we can see that there is a lack of input validation or output encoding on this parameter value. The first step performed in finding this vulnerability was to identify a valid injection point by crawling through the site and observing what endpoints reflect user input in the response.Īfter crawling the site, we noted that the query string parameter (q) is reflected in the response. By using a specially crafted payload we were able to bypass the WordFence WAF and inject malicious JavaScript into the web application. The WordFence WAF blocked us while attempting to inject malicious JavaScript into the parameter value. We discovered that a URL query string parameter value was being reflected in the immediate response from the application server. The WAF attempts to identify and block malicious traffic and additionally perform real-time IP blacklisting from malicious IPs.ĭuring a penetration test of a web application built on WordPress we noted that the target application was being protected by the WordFence WAF. WordFence is a WordPress security plugin that includes an endpoint firewall and malware scanner.

WAFs may come in the form of an appliance, server plugin, or filter, and may be customized to an application. By inspecting HTTP traffic, it can prevent attacks related to web application security flaws, such as SQL injection, cross-site scripting (XSS), and security misconfigurations. Edgescan Attack Surface Management, Penetration Testing and Vulnerability Management Platform Popular WordPress WAF bypass Zeroday discovered by Edgescan Ap2 min read WordFence WAF XSS Bypass – CVE-2019-9669 by Anthony YalcinĪ Web Application Firewall (WAF) is an application firewall that filters, monitors, and blocks malicious HTTP traffic.