0

I'm running a asp.net web application on Azure, I have an Application Gateway in front of it, enable the WAF (Web application Firewall).

But many of my http requests from the front-end are blocked by the WAF, for example my payload in JSON:

[{"inputtype":"text","name":"wwwwww","memo":"","score":1,"sort":1,"isrequired":false,"allowseeresult":false,"choicenummin":null,"choicenummax":null,"options":[]}]

The error message is: 

"message": "Warning. Pattern match \"((?: 
[\\\\~\\\\!\\\\@\\\\#\\\\$\\\\%\\\\^\\\\&\\\\*\\\\(\\\\)\\\\-\\\\+\\\\=\\\\ {\\\\}\\\\[\\\\]\\\\|\\\\:\\\\;\\\"\\\\'\\\\\\xc2\\xb4\\\\\\xe2\\x80\\x99\\\\\\xe2\\x80\\x98\\\\`\\\\<\\\\>][^\\\\~\\\\!\\\\@\\\\#\\\\$\\\\%\\\\^\\\\&\\\\*\\\\(\\\\)\\\\-\\\\+\\\\=\\\\{\\\\}\\\\[\\\\]\\\\|\\\\:\\\\;\\\"\\\\'\\\\\\xc2\\xb4\\\\\\xe2\\x80\\x99\\\\\\xe2\\x80\\x98\\\\`\\\\<\\\\>]*?){12})\" at ARGS:questions.",
"data": "Matched Data: [{\\x22inputtype\\x22:\\x22text\\x22,\\x22name\\x22:\\x22who is it\\x22 found within ARGS:questions: [{\\x22inputtype\\x22:\\x22text\\x22,\\x22name\\x22:\\x22who is it\\x22,\\x22memo\\x22:\\x22\\x22,\\x22score\\x22:1,\\x22sort\\x22:1,\\x22isrequired\\x22:true,\\x22allowseeresult\\x22:false,\\x22choicenummin\\x22:null,\\x22choicenummax\\x22:null,\\x22options\\x22:[]}]",
"file": "rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf",
"line": "1002"

Seems that "" is not allowed in the payload.

I tried to use htmlencode to encode the "" to "&quot ;" but the ";" still got blocked by WAF.

So how should I encode my payload to avoid it being blocked? Any recommendations? Thanks.

user9687
  • 81
  • 2
  • 8
  • REQUEST-942-APPLICATION-ATTACK-SQLI RuleIds and Descriptions may [help to drive some info](https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-crs-rulegroups-rules?tabs=owasp3#crs942) – Anton Aug 14 '19 at 04:41

1 Answers1

0

You can only do 2 things 1. Disable the rule, 2. Use an exclusion list, Link.

Jay seen
  • 493
  • 4
  • 14