Team82 researcher Noam Moshe describes the eight vulnerabilities found in Teltonika RUT routers and in its cloud management platform, the Teltonika Remote Management System, and three distinct attack vectors that emerged from this research.

Nexus Podcast: Noam Moshe on a Generic Bypass of Web Application Firewalls

Michael Mimoso
Dec 20, 2022

Web application firewalls are a crucial line of defense keeping databases and their contents at arm’s length from threat actors. A bypass of these security tools could put business and customer information in the hands of hackers, and impact business from a financial and regulatory perspective. 

In this episode of the Nexus Podcast, Team82 researcher Noam Moshe joins to discuss his recent research and development of a generic bypass of leading vendors’ web application firewalls

The attack technique exploits the vendors’ previous lack of support for JSON syntax in their SQL injection processes. WAFs were previously blind to JSON syntax prepended to a SQL injection payload and would not flag these as malicious. 

Team82’s research identified five affected vendors: Amazon Web Services, Palo Alto Networks, F5, Cloudflare, and Imperva. Each of the vendors’ WAF products now support JSON syntax, and have negated the impact of this technique. 

“What makes this bypass so rare is that we were able to find the generic bypass. Meaning, I don’t care what is between me and the application, I simply bypass almost any WAF between me and it,” Moshe said. “There have been WAF bypasses in the past, however, I don’t know of a generic one working on all major vendors.”

Moshe explained how Team82 came upon this technique almost by accident during an unrelated research project, and why vendors were lagging in adding JSON support in WAF inspection processes. 

“We arrived at JSON because it is implemented in all databases by default, so it was a good candidate,” he said. “We tried a few others, but JSON was the one that simply worked out of the box.” 

Michael Mimoso
Editorial Director

Michael Mimoso is Director of Influencer Marketing at Claroty and Editorial Director of Nexus.

Stay in the know

Get the Nexus Connect Newsletter

You might also like…

Read more

Latest on Nexus Podcast