[AWS WAF] AWS WAF Command Injection 방어 정책 만들기 [T]

Command Injection 이란?

• 공격자가 어플의 취약점을 악용하여 시스템 명령을 임의로 실행하는 공격
• 서버 운영체제 명령을 통해 권한을 상승하거나 민감한 정보에 접근 가능

 

AWS WAF에서 Command Injection 공격 방어 정책 만들기

1) AWS Console에서 WAF 접속
2) 왼측 Web ACLs -> 만든 ACL 선택
3) Rules -> Add rules -> Add my own rules and rule groups
4) Rule builder -> 이름 적고 -> Regular rule

"""Statement 1"""
5) if a request matches all the statement (AND)
5-1) Inspect = URL path
5-2) Match type = Starts with string
5-3) String to match = /vulnerabilities/exec/

"""AND NOT Statement 2"""
6) Negate statement results 설정
6-1) Inspect = Body
6-2) Match type = Matches regular expression
6-3) Regular expression = ^ip=(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}&Submit.*
6-4) Compress whitespace, URL decode
6-5) Oversize handling = Continue - Inspect the contents that are ~~

""" AND Statement3"""
7) Inspect = HTTP method
7-1) Match tpye = Exactly matches string
7-2) String to match = POST

"""Action"""
8) Block -> Enable -> 200 -> custom_denied -> Add rule -> Save