Azhar's Notes

WAF Red Team Engagement — Siklus 3: Response Layer & Missing Rules

6 menit baca

Ringkasan Siklus 3

Audit fokus pada response layer (DLP, security headers) dan gap rules yang belum diimplementasi dari DEVELOPMENT-REFERENCE.md — NoSQL Injection dan Prototype Pollution. Empat bug ditemukan, semua ditambal. Temuan paling berdampak: security headers yang dideklarasi lengkap di config tapi tidak pernah di-wire ke response (dead config).

Statistik: 4 bug (2 critical, 1 high, 1 medium) → 4 patched | 138/138 test pass | Commit c1fec6e

Daftar Isi

  1. NoSQL Injection — Gap P0
  2. Prototype Pollution — Gap P1
  3. DLP Response Scan
  4. Security Headers — Dead Config
  5. OpenAPI Validation
  6. JWT Validation — Dual System
  7. Ringkasan

NoSQL Injection — Gap P0

Masalah

DEVELOPMENT-REFERENCE.md mengidentifikasi NoSQL Injection sebagai gap P0 (critical). Pencarian di codebase mengkonfirmasi: tidak ada rule untuk MongoDB operator injection. Payload $ne, $gt, $regex, $where, $or sepenuhnya lolos.

Verifikasi Bypass (Sebelum Patch)

#PayloadHasil
1{"username":{"$ne":null},"password":{"$ne":null}}🟢 200 (auth bypass)
2?user=admin&pass[$ne]=x🟢 200
3{"q":{"$regex":".*"}}🟢 200
4{"$where":"this.password.length > 0"}🟢 200
5{"$or":[{"user":"admin"}]}🟢 200
6`user=admin

7/7 LOLOS. Auth bypass MongoDB sepenuhnya diteruskan ke backend.

Patch

src/rules/body.rs:

  • NOSQL-001: regex untuk MongoDB operator ($ne, $gt, $lt, $gte, $lte, $regex, $where, $nin, $exists, $type, $or, $and, $all, $size, $elemMatch, $not, $nor, $mod, $options, $slice, $comment)
  • NOSQL-002: regex untuk JS tautology (||, &&, $where function(), .map(), .find(), $$)
  • Kedua rule severity Critical, action Block
  • is_rule_enabled() ditambah starts_with("NOSQL-")

Verifikasi Setelah Patch

7/7 BLOCK (403). Benign JSON (tanpa operator): 200. ✅

Prototype Pollution — Gap P1

Masalah

DEVELOPMENT-REFERENCE.md mengidentifikasi Prototype Pollution sebagai gap P1 (high). Tidak ada rule di codebase.

Verifikasi Bypass (Sebelum Patch)

#PayloadHasil
1{"__proto__":{"isAdmin":true}}🟢 200
2{"constructor":{"prototype":{"isAdmin":true}}}🟢 200
3?__proto__[isAdmin]=true🟢 200
4?constructor[prototype][x]=y🟢 200
5{"user":{"__proto__":{"role":"admin"}}}🟢 200

6/6 LOLOS.

Patch

src/rules/body.rs:

  • PROTO-001: regex (?i)(__proto__|constructor\s*\.\s*prototype|\bprototype\b|\[\s*['__proto__']\s*\])
  • Severity High, action Block
  • is_rule_enabled() ditambah starts_with("PROTO-")

Verifikasi Setelah Patch

5/5 BLOCK (403). Benign JSON: 200. ✅

DLP Response Scan

Arsitektur

src/dlp.rs mengimplementasikan 6 pattern regex + masking:

  • DLP-CC (credit card): 13-19 digit, optional space/dash grouping
  • DLP-JWT: eyJ...eyJ... pattern
  • DLP-CLOUD: AWS access key (AKIA…), AWS secret, Azure key, GCP key, GitHub token (ghp_), Slack token (xox)
  • DLP-PASS: "password"|"secret"|"token"|"api_key" : "value" heuristic
  • DLP-EMAIL: standard email regex
  • DLP-CUSTOM: user-defined patterns dari config

Anti-bypass: zero-width character stripping (U+200B/C/D), allowlist per-vhost, body size limiting (1MB scan, 2MB response_body_limit).

Verifikasi Live

Config: action = "log" (monir tanpa block). Backend DLP di port 8000 mengembalikan data sensitif:

EndpointPatternStatusLog Entry
/dlp-ccCredit card✅ 200 + logDLP-CC: credit card number (sample: 4111…1111)
/dlp-jwtJWT token✅ 200 + logDLP-JWT: JWT / Bearer token
/dlp-cloudAWS key✅ 200 + logDLP-CLOUD: cloud provider secret key
/dlp-passPassword✅ 200 + logDLP-PASS: password / secret in response body
/dlp-emailEmail✅ 200 + logDLP-EMAIL: email address (sample: admin@...)
/dlp-cleanClean data✅ 200(no log)

Catatan: action=“block” Menghasilkan 502

Dengan action = "block", DLP mengembalikan Err(HTTPStatus(502)) karena response sudah partially committed di pingora streaming pipeline. Ini desain pingora, bukan bug — DLP bekerja di response_body_filter yang berarti headers sudah terkirim. Block di tahap ini menghasilkan connection error yang pingora render sebagai 502, bukan custom 403.

Rekomendasi: gunakan action = "log" untuk monitoring + alerting, atau action = "mask" untuk redact sensitive data.

Security Headers — Dead Config

Masalah (MEDIUM)

SecurityHeadersConfig di src/config.rs dideklarasi lengkap dengan defaults: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Resource-Policy, extra_headers.

Config di-load ke ctx.security_headers di request_filter (line 967):

ctx.security_headers = vhost_cfg.security_headers.clone();

TAPI: response_filter (method yang mengatur upstream response headers) tidak membaca ctx.security_headers. Hanya menambah X-RateLimit-* headers. Security headers tidak pernah diterapkan — dead config.

Verifikasi (Sebelum Patch)

$ curl -sD - http://127.0.0.1:8080/api/users -H 'Host: target.jarswafwaf.demo' | grep -iE "CSP|HSTS|X-Frame|X-Content|Referrer|Permissions"
(empty — zero headers)

0/8 security headers ada di response.

Patch

src/proxy_engine.rs response_filter() — menambah blok kode yang membaca ctx.security_headers dan insert header ke upstream response:

if let Some(ref sh) = ctx.security_headers {
    if sh.enabled {
        let _ = upstream_response.insert_header("Server", "jarswaf");
        if let Some(ref csp) = sh.content_security_policy {
            let _ = upstream_response.insert_header("Content-Security-Policy", csp);
        }
        if let Some(ref hsts) = sh.strict_transport_security { ... }
        if let Some(ref xfo) = sh.x_frame_options { ... }
        if let Some(ref xcto) = sh.x_content_type_options { ... }
        if let Some(ref rp) = sh.referrer_policy { ... }
        if let Some(ref pp) = sh.permissions_policy { ... }
        if let Some(ref corp) = sh.cross_origin_resource_policy { ... }
        for (k, v) in &sh.extra_headers { ... }
    }
}

Verifikasi (Setelah Patch)

✅ Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'
✅ Strict-Transport-Security: max-age=31536000; includeSubDomains
✅ X-Frame-Options: DENY
✅ X-Content-Type-Options: nosniff
✅ Referrer-Policy: strict-origin-when-cross-origin
✅ Permissions-Policy: camera=(), microphone=(), geolocation=()
✅ Cross-Origin-Resource-Policy: same-origin
✅ Server: jarswaf

8/8 security headers aktif. Sebelumnya 0/8.

OpenAPI Validation

Status Kode

check_openapi_schema_validation di src/rules/api.rs:12 implementasi lengkap:

  • Path + method matching dengan {param} placeholder support
  • Required parameter check
  • Type validation: integer, boolean, string

is_rule_enabled("OPENAPI-*") aktif di test_config.

Gap Operasional (INFO)

api_schemas: Vec::new() di config — tidak ada schema yang dikonfigurasi. Tanpa schema, schemas.iter().find(...) return None → tidak ada inspeksi. Fitur tidak broken, hanya belum digunakan di lab.

Untuk deploy production, user harus menyediakan schema di [[api_schemas]] config block:

[[api_schemas]]
path = "/api/users"
method = "GET"
 
[[api_schemas.parameters]]
name = "page"
param_type = "integer"
required = true

JWT Validation — Dual System

Dua Sistem Paralel

SistemFileScopeResponse CodeRule ID
Structure checkapi_security.rs:5Path /api/* only401API-JWT-001
Token inspectionapi.rs:84All paths (if JWT-* enabled)403JWT-VALIDATION

Verifikasi Live

PayloadHasilSistem yang Aktif
Expired JWT (exp=2018)✅ 403 BLOCKJWT-VALIDATION (exp check)
Malformed (2 parts)✅ 401 BLOCKAPI-JWT-001 (structure)
No “Bearer ” prefix⚠️ 200 PASSTidak ada validator handle
JWT tanpa exp claim⚠️ 200 PASSNo signature/issuer validation
Not-a-JWT✅ 403 BLOCKJWT-VALIDATION (base64 decode fail)
No auth header✅ 200 PASSBenar (tidak ada yang diuji)

Catatan

  1. 401 vs 403 inkonsistensi — desain, bukan bug. 401 = client auth format error (structure), 403 = valid format tapi rejected (expired). Sistem umum Mengikuti konvensi.
  2. No “Bearer ” prefix — validate_jwt_structure only checks if starts_with("bearer "). JWT raw tanpa prefix lolos. Mitigasi: backend should reject raw JWT (best practice backend-side validation).
  3. No signature validation — WAF tidak punya secret key backend, jadi tidak bisa validasi signature. Design constraint. WAF hanya validasi struktur + expiry.

Ringkasan

KomponenTemuanSeverityStatus
NoSQL Injection7 payload MongoDB operator LOLOS🔴 Critical✅ PATCHED (NOSQL-001/002)
Prototype Pollution6 payload proto LOLOS🔴 High✅ PATCHED (PROTO-001)
DLP Response6 pattern verified live⚪ Info✅ Working
Security HeadersConfig dead, 0/8 headers applied🟡 Medium✅ PATCHED (8/8 active)
OpenAPI ValidationNo schema in config⚪ Info⚠️ Operational gap
JWT ValidationDual system verified⚪ Info✅ Working

Total: 4 bug ditemukan, 4 patched. 138/138 test pass. Commit c1fec6e.

Statistik Kumulatif Siklus 1-3

MetrikSiklus 1Siklus 2Siklus 3Total
Bug ditemukan96419
Bug patched96419 (100%)
Test pass135135138138
Commits3115

Cross-References

Tampilan Grafik

Tautan Balik