OWASP Global AppSec Lisbon 2024

Web application firewalls (WAFs) protect Web Applications and API from a wide-range of attacks, and their adoption is widely confirmed even if their effectiveness is the center of many debates in the community. In particular, the popularity of WAFs has been mainly provided by ModSecurity, a signature-based detection program that leverages the Core Rule Set, a list of rules developed by experts in the domain.  These are released as open-source projects, fostering their deployment, and easing their inclusion in many commercial WAFs. 


However, recent research highlighted how attackers can automate the adaptation of attacks to a specific WAF, thus creating subtle payloads that systematically avoid detection. This problem is exacerbated by the fact that the tuning of the Core Rule Set in production environments is the outcome of a manual trial and error process, where rules that may interfere with applications and services are progressively disabled. Thus attackers can exploit such heuristic nature to their advantage. 


In this talk we will address the robustness of WAFs against attackers, showing that the detection strategy implemented by ModSecurity, is largely ineffective for detecting SQL injection (SQLi) attacks, as it is not tuned on the legitimate traffic it needs to protect, thus increasing false alarms,while also being vulnerable to adversarial SQLi attacks, i.e., attacks intentionally manipulated to evade detection.


To better understand how attackers can exploit the weaknesses of WAFs, we will provide an overview on how ModSecurity and Core Rule Set are used together, and how they stop malicious payloads, providing insights on their internals. We will conclude  by proposing possible strategies to optimize the trade-off between false alarms and detection rate, while also increasing robustness against adversarial attacks through adversarially-aware machine learning models.