6.3.5. Update Parent WAF Policy

Task 1 - Simulate attacks to demonstrate newly discovered vulnerability.

1. Open browser and go to https://<Elastic IP>/account/documents?page=delivery.html;%20cat%20/etc/passwd

2. Enter credentials to login successfully.

   

   Note

   This is a common OS command injection attack. Upon successful login it displayed the desired page along with the results for cat /etc/passwd.

Task 2 - Modify the parent waf policy to mitigate the command injection vulnerability

1. Open the Security -> Application Security -> Security Policies -> Policies List page

2. Select waf_base then click waf_base to view properties

   

3. Click on Attack Signatures Configuration

4. On the Attack Signatures section click Change

   

5. Click OS Command Injection Signatures check box then click Change

   

6. Click Save at the bottom of the properties page

7. Click Apply Policy to commit changes

   

Task 6 - Repeat simulated command injection attack

1. Open browser and go to https://<Elastic IP>/account/documents?page=delivery.html;%20cat%20/etc/passwd

2. Your request should be rejected.

   Note

   Updates to the Parent policy will be inherited by the Child policies based on the Inheritance configuration. Since waf_base parent policy Attack Signatures was Mandatory all Child policies inherited the changes.