JSON syntax is supported by all major SQL engines and it’s enabled by default.Ĭlaroty researchers used a JSON syntax to craft a new SQL injection payload that would bypass the WAF - because the WAF did not understand it - while still being valid for the database engine to parse. They discovered a SQL injection vulnerability that could be used to obtain sensitive information, such as session cookies, tokens, SSH keys and password hashes.Įxploitation of the flaw worked against the on-premises version, but an attempt to exploit it against the cloud version was blocked by the Amazon Web Services (AWS) WAF, which flagged the SQL injection payload as malicious.įurther analysis revealed that the WAF could be bypassed by abusing the JSON data sharing format.

Researchers at industrial and IoT cybersecurity firm Claroty have identified a generic method for bypassing the web application firewalls (WAFs) of several major vendors.Ĭlaroty’s researchers discovered the method following an analysis of Cambium Networks’ wireless device management platform.

Waf cyber security