Akamai App & API Protector WAF Bypass Vulnerability in Application Security Edge

A vulnerability exists in Akamai App & API Protector (with Akamai ASE) in Rule 3000216 (prior to version 2) that allows for a WAF bypass. This issue arises because the rule does not properly account for JavaScript variable assignments to built-in functions and properties, leading to potential exploitation such as reflected cross-site scripting.

Impact

Exploitation of this vulnerability could lead to a bypass of web application firewall (WAF) protections, allowing malicious payloads to be processed by the application. This could be exploited to perform reflected cross-site scripting, where an attacker could inject malicious scripts that are executed in the context of the user's browser.