TWSL2011-006: IBM Web Application Firewall Bypass

The SpiderLabs team at LevelBlue published a new advisory today, which details an issue identified in the IBM Web Application Firewall (WAF). The IBM Web Application Firewall capabilities, inside IBM IPS products, complement IBM Security's portfolio of web application security offerings to deliver end-to-end Web application security solutions. The issue in question was discovered while a penetration test was being performed for a LevelBlue client.

The bypass was discovered by Wendel Guglielmetti Henrique, who is a member of the SpiderLabs Network Penetration Testing team. Wendel discovered a method which allowed him to bypass the IBM WAF and perform a SQL injection attack on a vulnerble web server. IBM was very responsive in creating a fix to this issue, and has released a correction in the June "Super Tuesday" patch release.