WAFFLED: Exploiting Parsing Discrepancies to Bypass Web Application Firewalls

1. Problem Statement

Web Application Firewalls (WAFs) are critical security controls designed to inspect HTTP traffic and filter out malicious requests (e.g., SQL Injection, XSS). However, they are not immune to evasion. Traditional evasion techniques often rely on obfuscating payloads (encoding, character injection) or manipulating protocol features (HTTP Request Smuggling).

The core problem identified in this research is parsing discrepancies. Different entities in the communication chain (the WAF vs. the backend Web Application Framework) may interpret the same HTTP request differently due to inconsistencies in how they handle:

• RFC standards compliance.
• Complex content structures (nested data, boundaries).
• Specific content types (multipart/form-data, application/xml, application/json).

Attackers can exploit these discrepancies by crafting requests that the WAF parses as "safe" (ignoring the malicious payload) while the backend framework parses them as "valid" (executing the malicious payload).

2. Methodology: WAFFLED

The authors developed WAFFLED, a novel approach utilizing black-box fuzzing to automatically discover these parsing discrepancies.

• Core Concept: Instead of mutating the attack payload itself (which is the standard evasion tactic), WAFFLED keeps the payload intact and mutates non-malicious structural elements (headers, boundaries, namespaces, whitespace).
• The Fuzzing Pipeline:
  1. Input Generation: A grammar-based fuzzer generates valid HTTP requests containing known attack payloads (XSS, SQLi).
  2. Mutation: The fuzzer applies mutations to specific content elements (e.g., altering boundary delimiters in multipart data, modifying XML namespaces, or injecting null bytes \x00 into JSON keys).
  3. Testing Infrastructure: The mutated requests are sent through a WAF to a target Web Application Framework (WAF).
  4. Validation: The system checks if the WAF allowed the request through and if the backend framework successfully parsed the payload. A bypass is confirmed only if the payload is executed by the backend.
• Scope:
  • WAFs Tested: Cloudflare, AWS WAF, Azure WAF, Google Cloud Armor, and ModSecurity (on NGINX).
  • Frameworks Tested: Flask, FastAPI, Gin, Express, Laravel, Spring Boot, and Node.js-HTTP.
  • Content Types: multipart/form-data, application/xml, and application/json.

3. Key Contributions

1. New Evasion Paradigm: Introduced a fundamentally new approach to WAF bypassing that relies on content parsing discrepancies rather than payload obfuscation.
2. Automated Discovery Pipeline: Designed and implemented a pipeline to systematically identify discrepancy-based bypass vectors using fuzzing.
3. Large-Scale Empirical Study: Conducted extensive testing across 5 major WAFs and 7 popular frameworks, identifying 1,207 unique bypass instances.
4. Real-World Validation: Analyzed 100 real-world websites (via PublicWWW) and found that >90% accept application/x-www-form-urlencoded and multipart/form-data interchangeably, proving the practical applicability of the findings.
5. Mitigation Tool (HTTP-Normalizer): Developed a proof-of-concept proxy tool that enforces strict RFC compliance. It normalizes requests (removing ambiguous features) or rejects non-compliant ones, effectively neutralizing the discovered bypasses.

4. Key Results and Findings

Vulnerability Statistics

• Total Bypasses: 1,207 unique bypasses were identified.
• Breakdown by Content Type:
  • JSON: 557 bypasses (e.g., manipulating field wrappers, replacing quotes, altering Content-Type parameters).
  • Multipart: 351 bypasses (e.g., boundary delimiter manipulation, header injection into body, whitespace alteration).
  • XML: 299 bypasses (e.g., DOCTYPE closure confusion, schema closure manipulation, misplaced fields).
• Vulnerability Rate: 100% of the tested WAF/Framework pairs were vulnerable to at least one bypass technique.
• Vendor Specifics:
  • ModSecurity, Cloudflare, Azure, and Google Cloud Armor: All were successfully bypassed.
  • AWS WAF: Was the only vendor not successfully bypassed in this study, likely due to stricter parsing adherence.

Classification of Bypass Techniques

The authors categorized the bypasses into 24 distinct attack types based on the mutation strategy. Notable examples include:

• Boundary Delimiter Manipulation: Removing \r\n before a boundary string to confuse the WAF's parsing logic.
• Parameter Continuation Abuse: Using HTTP header continuation features (e.g., boundary*0=...; boundary*1=...) which some WAFs ignore but frameworks parse.
• Null Byte Injection: Inserting \x00 characters into field names or delimiters to truncate parsing in the WAF while the framework continues.
• Case Sensitivity & Whitespace: Altering capitalization or inserting tabs/spaces in headers to bypass regex-based rules.

Real-World Applicability

A study of 100 high-ranking "forgot password" pages revealed that:

• 66% use application/x-www-form-urlencoded.

• ~25% use application/json.
• Crucially: >90% of these sites accept multipart/form-data interchangeably with their native format. This means an attacker can easily switch the content type to exploit multipart-specific bypasses on sites that primarily use form-urlencoded.

5. Significance and Mitigation

Significance:

• Critical Vulnerability: The findings reveal that WAFs often fail to parse requests with the same fidelity as the backend application, creating a "blind spot" for attackers.
• Beyond Obfuscation: This shifts the security focus from "hiding the payload" to "tricking the parser," a more robust and harder-to-defend vector.
• Vendor Impact: Major cloud providers and open-source projects (ModSecurity) acknowledged the vulnerabilities. Some received bug bounties (e.g., Google Cloud Armor), while others are transitioning to new rule sets (e.g., Azure moving from CRS 3.0 to DRS 2.1).

Mitigation (HTTP-Normalizer):
The authors propose HTTP-Normalizer, a proxy tool that sits between the client and the WAF/Framework.

• Function: It parses incoming requests using a strict ABNF (Augmented Backus-Naur Form) grammar derived from RFCs.
• Action:
  • Normalize: It reconstructs the request, removing deprecated features, optional fields, and ambiguous whitespace, ensuring a canonical form.
  • Reject: If a request contains non-compliant structures (e.g., malformed boundaries), it is dropped immediately.
• Effectiveness: Testing showed that the normalizer successfully blocked or normalized 100% of the bypass attempts, preventing the WAF and Framework from ever seeing the discrepancy.

Conclusion

The paper demonstrates that parsing discrepancies are a widespread and critical vulnerability in modern web security architectures. By exploiting the differences in how WAFs and frameworks interpret complex content types, attackers can bypass even the most popular security gateways. The authors provide both a comprehensive catalog of these vulnerabilities and a practical solution (HTTP-Normalizer) to enforce RFC compliance, thereby closing the gap between security inspection and application processing.