search

appsmithorg / appsmith

Platform to build admin panels, internal tools, and dashboards. Integrates with 25+ databases and any API.
https://www.appsmith.com
Apache License 2.0
33.95k stars 3.66k forks source link

[Bug]: AWS WAF Rule Blocking JS Update PUT Requests #28831

Open riteshkew opened 10 months ago

riteshkew commented 10 months ago

Is there an existing issue for this?

Description

AWS#AWSManagedRulesSQLiRuleSet#SQLi_BODY' rule is intermittently blocking about 10% of Custom JS update PUT requests for a user. This rule, designed to prevent SQL injection attacks, appears to be overly sensitive even at its default low setting. The issue was identified when a user's DevOps team discovered that the rule was obstructing requests involving a function named 'createSearchString', which constructs a SQL where clause.

Our initial analysis suggests that this behavior is unusual, as it does not affect similar query update requests and the problem has not been reported by other users. Since AWS managed rules cannot be edited, only disabled, we are considering options to modify our request payloads to avoid triggering the rule. However, this requires further investigation as we currently do not have a mechanism in place to obfuscate our payloads or implement alternative strategies to bypass the rule.

This ticket aims to start gathering data and exploring potential solutions, including but not limited to payload obfuscation or other techniques, to address this challenge. We need to ensure that our application's functionalities are not hindered by such WAF rules while maintaining security against SQL injection threats.

A-force thread : https://theappsmith.slack.com/archives/C0341RERY4R/p1697487010803149

Steps To Reproduce

  1. Create an AWS WAF Rule for SQL
  2. Deploy Appsmith on AWS using ELB and add the WAF rule.
  3. Keep updating any JSObject and after a while observe that all further requests fail with 403.
  4. This is happening because the WAF rule/firewall keeps blocking the request considering it as a SQL injection.

Public Sample App

No response

Environment

Production

Issue video log

No response

Version

1.9.44

bharath31 commented 10 months ago

@satbir121 what are the next steps here?

satbir121 commented 10 months ago

We will pick this up later. We are not able to prioritise it right now.