Web Application Defender's Cookbook

Recipe 5-2: Identifying Malformed Request Bodies

This recipe demonstrates that ModSecurity can generate errors when request bodies are malformed.

Ingredients

• ModSecurity
  • REQBODY_ERROR variable
  • MULTIPART_STRICT_ERROR variable

When ModSecurity attempts to parse request body content, it generates various errors if it encounters any problems. This capability is essential, because attackers often attempt to purposefully craft the payloads in a way that bypasses security inspection but still executes the intended attack against the target web application.

Caution

Impedance Mismatches

Although having our external security enforcement layer protect our web applications has obvious advantages, this architecture does pose one significant challenge. Each web application technology (ASP.NET, PHP, Java) analyzes, parses, extracts, and interprets HTTP transactional data in different, often unexpected, ways. This can cause false-negative evasion scenarios if your security layer analysis does not match that of the protected web application. This situation is called impedance mismatching.

Here are a couple impedance mismatching examples that you should be aware of:

• HTTP parameter pollution (HPP) was identified by security researchers Stefano Di Paola and Luca Carettoni in 2009.2 HPP works by appending additional parameters to requests. These parameters either alter business logic or are used for security filter evasion. In the latter case, web applications react differently when ...