A security team needs to prevent a remote code execution vulnerability. The vulnerability can be exploited only by sending '${ string in the HTTP request. WAF rule is blocking '${', but system engineers detect that attackers are executing commands on the host anyway. Which action should the security team recommend?

The most likely reason for the successful attack is an evasion technique using URL encoding. Attackers can encode the malicious string ${ into its URL-encoded equivalent, %24%7B. If the Web Application Firewall (WAF) does not decode this input before applying its rules, it will fail to match the literal block rule for ${}. The request then passes to the backend server, which correctly decodes %24%7B back to ${}, triggering the remote code execution vulnerability. Enabling URL decoding on the WAF is a critical normalization step that ensures encoded malicious payloads are identified and blocked before they reach the application.

B. Block incoming web traffic. This is a drastic denial-of-service action that would stop all legitimate user traffic, not a targeted solution to fix a specific WAF rule bypass.
C. Add two WAF rules to block '$' and '{' characters separately. This approach is overly broad and would likely generate numerous false positives, blocking legitimate application functions that use these common characters (e.g., in JSON or scripts).
D. Deploy antimalware solution. An antimalware solution is a host-based control that detects malicious files or processes after a compromise; it does not prevent the initial network-based exploit vector.

1. Cisco

Snort 3 User Manual

"HTTP inspector" section: The official Snort 3 manual

the engine used in Cisco security products

states

"The HTTP inspector normalizes HTTP fields before they are passed to rules for detection." This normalization process includes decoding URL-encoded characters to prevent evasion of detection rules. This directly supports that decoding is the correct mechanism to counter this type of bypass.

2. MIT OpenCourseWare

6.858 Computer Systems Security

Fall 2014

Lecture 14: Web Security

Slide 28 "Input sanitization": University courseware from MIT explains canonicalization attacks

where an attacker uses different encodings (e.g.

URL encoding

HTML entities) to bypass security filters. The lecture notes emphasize the need to decode and normalize all input to a canonical form before validation

which aligns with enabling URL decoding on the WAF.

3. Cisco

"Intrusion Prevention System (IPS) Evasion Techniques and Countermeasures"

White Paper

Section: "Obfuscation": This official Cisco white paper discusses how attackers use various encoding and obfuscation techniques

including URL encoding (or percent-encoding)

to evade security devices. The document specifies that the countermeasure is for the security device (like a WAF/IPS) to perform normalization and decoding of traffic to detect the true payload.