Imperva 11.5 Detection Bypass
Posted on 07 November 2016
################################################# Bypass Imperva by confusing HTTP Pollution Normalization Engine ################################################# Author: Wiswat Aswamenakul Environment: Tested with Imperva Version: 11.5 and Web Backend as IIS + ASP Description: One of technique that attackers use to bypass web application firewall is to use HTTP pollution attack. The attack can be produced by sending parameters with the same name to web application and the result on the web application will depend on which web server and language used on the server. IIS and ASP will combine all the value together separated each one with "," (comma). For example, http://www.example.com/sqli.asp?a=first&a=second The page sqli.asp will see "a" parameter as "first,second" (without double quote). Therefore, attackers could craft attack string as following: http://www.example.com/sqli.asp?a=nonexist'/*&a=*/or/*&a=*/1=1/*&a=*/--+- The page sqli.asp will sess "a" parameter as "'/*,*/or/*,*/1=1/*,*/--+-" (without double quote). Some web application firewall will fail detecting this attack. However, Imperva handles this type of attack by combining all the parameters with same name like IIS+ASP does (I call it normalization engine) before passing the end result to detection engine. However, I have found that there is a trick, bug, vulnerability, feature, (you name it) that allows the normalization engine to create end results different from IIS+ASP does. [+] Attack that can be detected by Imperva http://www.example.com/sqli.asp?a=nonexist'/*&a=*/or/*&a=*/1=1/*&a=*/--+- [+] Attack that can bypass Imperva http://www.example.com/sqli.asp?a=nonexist'/*&a%00=*/or/*&a=*/1=1/*&a%00=*/--+- *Please notice the %00 in parameter name Imperva treats a and a%00 as different parameters. As a result, when combining the parameter with the same name, it will not see a valid attack string. On the other hand, IIS+ASP see a and a%00 as the same parameters. Apache and PHP also see a and a%00 as the same parameters. Other combinations have not been tested yet. PS. Other web application firewall might be tricked by this technique to bypass their detection but I don't have devices for testing.
