Is F5 WAF support JSON syntax in their SQL injection inspection process.

8 Replies

Amine_Kadimi
MVP
Dec 09, 2022
Json is just a way to represent data using a specific string formatting standard. In short any json is a string.

In the other hand, F5 checks string inputs against signature matches, so sql injection can be detected in any string input.

Putting this together, F5 waf can detect malicious data in json inputs.

If this is not what you are asking for, could you provide further details?
MACTEP
Altocumulus
Dec 11, 2022
I guess, the question was related to this article
https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf
which implies that F5 can't detect sql injection in any string.
- pravinmeshram
  Nimbostratus
  Dec 12, 2022
  Yes it is
Cyber_JCCP
Nimbostratus
Dec 12, 2022
So, Im not clear. Does F5 already provided an update to mitigate this or it is not affected by the new technique, or what?
HPJCarlson
Nimbostratus
Dec 12, 2022
The accepted answer does not really answer the poster was looking for, see below link, is the F5 currently susceptable to this JSON syntax attack?
https://securityaffairs.co/wordpress/139445/hacking/web-application-firewalls-waf-bypass.html
- Amine_Kadimi
  MVP
  Dec 12, 2022
  The original question was general, so was the answer.
  
  Attackers or researchers crafting specific attack patterns that could bypass the WAF is something not uncommon. This is why signatures updates are there for. And this is not specific to json inputs.
  - chrissaint
    Nimbostratus
    Dec 14, 2022
    Are you an actual support representative? Or just being combative for fun?
Cyber_JCCP
Nimbostratus
Dec 14, 2022
Hey guys, this might help clarify the issue on topic.
link: Original Claroty Security research post by Noam Moshe - The articule by Claroty that all news outlets refer to. At the end of the articule there is a small bit where it says that AWS and F5 already have created/updated their product to block the technique.
link: F5 SIRT acknowledgement to Noam Moshe of Claroty Research - Here are the Signature IDs created to block the technique. You can check them on the link: F5 Attack sigs Security Details page. Just copy paste the Sig IDs and you will see a bit more detail on them.

Hope this helps.