Imperva SecureSphere Web Application Firewall SQL Injection Filter Bypass Vulnerability

A SQL injection filter bypass vulnerability has been identified in Imperva SecureSphere Web Application Firewall (WAF) versions prior to August 12, 2010. This vulnerability allows attackers to evade SQL injection protections by exploiting a typo in the WAF's SQL injection detection rules. The bypass is achieved by appending a crafted string that manipulates the WAF's filtering mechanism, enabling potentially malicious SQL injection payloads to be processed without detection.

Impact

Exploitation of this vulnerability allows for SQL injection attacks to be carried out undetected by the WAF, potentially leading to unauthorized database access, data manipulation, or execution of arbitrary SQL commands.

Reproduction

To reproduce this vulnerability, send a request that includes a SQL injection payload appended with a specific string that exploits the typo in the WAF's SQL injection rules. The payload should be crafted to include a SQL injection vector that the WAF would normally block, but modified to bypass the filter by taking advantage of the rule error.

Remediation

Users are advised to apply the ADC Content Update from August 12, 2010.