Set to ‘ allow’ instead of ‘block’ - this is a very bad idea as setting it to allow will short-circuit any subsequent rules and let the nefarious cookie through with the request. The workaroundsĪssuming your default action is ‘accept’ requests unless an ACL rule is applied then Service team is actively tracking all false positives and continuously make improvements. However, since this signature was derived from a sample of real XSS attacks, it can’t be removed or altered inside the AWS Managed Rule CrossSiteScripting patterns, as this could potentially expose WAF to many other malicious requests and customers to currently-blocked attacks. Please note, the AWS WAF team is aware of such false positives. AWS check for XSS by comparing the requests with that of the standard XSS attacks mentioned in the OWASP cheatsheet, AWS said example-cookie: dummyoerigj3485df onbjneriyj4785= Can’t AWS fix this? Once you enable the AWS-AWSManagedRulesCommonRuleSet and set CrossSiteScripting_COOKIE to a block action you are likely to experience false positives - AWS are identifying cookies with the ‘on’ keyword in cookies as XSS even if they’re legitimate encrypted/encoded strings used by your web application. False Positivesīut why take the risk? Let’s block XSS Cookies! For extra protection, I have enabled the WAF ACL rules to block XSS, but the WAF can easily flag genuine cookies as XSS and block them - A.K.A false positives. I escape all HTML output so this cookie issue shouldn’t be a problem. However, if I echo the cookie into a page render (perhaps for example in my admin page) then the JavaScript could be executed and then the hacker could obtain my authorization cookie with direct access to admin features thereafter.
In theory, a hacker adding a script to a cookie doesn’t expose any risk to my website. The pattern in this case closely resembles JavaScript events such as “ onclick”, “ onload”
If the part of the request being inspected contains the string “on”, then the request will be blocked by XSS filters. This is because JavaScript functions such as ‘onclick’ can cause the nefarious script to be executed, as explained by AWS support to one of my tickets: The AWS-managed rules in the WAF are very sensitive about the ‘on’ keyword appearing anywhere in any cookie.
XSS COOKIE VIEWER CODE
The attacker can send malicious code (typically JavaScript) to a different end-user. Security - protecting against XSS with AWS WAFĬross-Site Scripting (XSS) attacks are a type of injection where malicious scripts are injected into otherwise benign and trusted websites.
0 kommentar(er)
