HTML command injection protection check
The HTML command injection check examines if the incoming traffic has unauthorized commands that break the system security or modify the system. If the traffic has any malicious commands when detected, the appliance blocks the request or performs the configured action.
The Citrix Web App Firewall profile is now enhanced with a new security check for command injection attacks. When the command injection security check examines the traffic and detects any malicious commands, the appliance blocks the request or performs the configured action.
In a command injection attack, the attacker aims to run unauthorized commands on the Citrix ADC operation system. To achieve this, the attacker injects operating system commands using a vulnerable application. A Citrix ADC appliance is vulnerable to injection attacks if the application passes any unsafe data (forms, cookies, or header) to the system shell.
How command injection protection works
For an incoming request, WAF examines the traffic for keywords or special characters. If the incoming request has no patterns that match any of the denied keywords or special characters, the request is allowed. Otherwise, the request is blocked, dropped, or redirected based on the configured action.
- If you prefer to exempt a keyword or a special character from the list, you can apply a relaxation rule to bypass the security check under specific conditions.
- You can enable logging to generate log messages. You can monitor the logs to determine whether responses to legitimate requests are getting blocked. A large increase in the number of log messages can indicate attempts to launch an attack.
- You can also enable the statistics feature to gather statistical data about violations and logs. An unexpected surge in the stats counter might indicate that your application is under attack. If legitimate requests are getting blocked, you might have to revisit the configuration to see if you must configure new relaxation rule or modify the existing one.
Keywords and special characters denied for command injection check
To detect and block command injection attacks, the appliance has a set of patterns (keywords and special characters) defined in the default signature file. Following is a list of keywords blocked during command injection detection.
<commandinjection> <keyword type="LITERAL" builtin="ON">7z</keyword> <keyword type="LITERAL" builtin="ON">7za</keyword> <keyword type="LITERAL" builtin="ON">7zr</keyword> … </commandinjection>
Special characters defined in the signature file are:
| ; & $ > < ' \ ! >> #
Configuring command injection check by using the CLI
In the command line interface, you can use either the set the profile command or the add the profile command to configure the command injection settings. You can enable the block, log, and stats actions. You must also set the key words and string characters that you want to detect in the payloads.
At the command prompt, type:
set appfw profile <profile-name> –cmdInjectionAction <action-name> -CMDInjectionType <CMDInjectionType>]
By default, the command injection action is set as “None.” Also, the default command injection type is set as
set appfw profile profile1 -cmdInjectionAction block -CMDInjectionType CmdSplChar
Where, the available command injection actions are:
- None - Disable command injection protection.
- Log - Log command injection violations for the security check.
- Block - blocks traffic that violates the command injection security check.
- Stats - Generates statistics for command injection security violations.
Where, the available command injection types are:
- Cmd SplChar. Checks special characters
- CmdKeyWord. Checks command injection Keywords
- CmdSplCharANDKeyWord. Checks special characters and command injection. Keywords and blocks only if both are present.
- CmdSplCharORKeyWord. Checks special characters and command injection Keywords and blocks if either of them is found.
Configuring relaxation rules for command injection protection check
If your application requires you to bypass the command injection inspection for a specific ELEMENT or ATTRIBUTE in the payload, you can configure a relaxation rule.
The command Injection inspection relaxation rules have the following syntax:
bind appfw profile <profile name> –cmdInjection <string> <URL> -isregex <REGEX/NOTREGEX>
Example for relaxation rule for Regex in header
bind appfw profile sample -CMDInjection hdr "http://10.10.10.10/" -location heaDER -valueType Keyword '[a-z]+grep' -isvalueRegex REGEX
As a result, the injection exempts the command injection check allows header ‘hdr’ containing variants of “grep.”
Example for relaxation rule with valueType as regex in cookie
bind appfw profile sample -CMDInjection ck_login "http://10.10.10.10/" -location cookie -valueType Keyword 'pkg[a-z]+' -isvalueRegex REGEX
Configuring command injection check by using Citrix ADC GUI
Complete the following steps to configure the command injection check.
- Navigate to Security > Citrix Web App Firewall and Profiles.
- On the Profiles page, select a profile and click Edit.
- On the Citrix Web App Firewall Profile page, go to the Advanced Settings section and click Security Checks.
- In the Security Checks section, select HTML Command Injection and click Action settings.
In the HTML Command Injection Settings page, set the following parameters:
- Actions. Select one or more actions to perform for command injection security check.
- Check Request Containing. Select a command injection pattern to check if the incoming request has the pattern.
- Click OK.
Viewing command injection traffic and violation statistics
The Citrix Web App Firewall Statistics page shows security traffic and security violation details in a tabular or graphical format.
To view security statistics by using the command interface.
At the command prompt, type:
stat appfw profile profile1
|Appfw profile Traffic Statistics||Rate (/s)||Total|
|Long Term Ave Response Time (ms)||–||0|
|Recent Ave Response Time (ms)||–||0|
|HTML/XML/JSON Violation Statistics||Rate (/s)||Total|
|Referer header 0||0|
|Buffer overflow 0||0|
|Cookie consistency 0||0|
|CSRF form tag||0||0|
|HTML Cross-site scripting||0||0|
|HTML SQL injection||0||0|
|JSON Denial of Service||0||0|
|JSON SQL injection||0||0|
|JSON Cross-Site Scripting||0||0|
|File Upload Types||0||0|
|Infer Content Type XML Payload||0 0|
|HTML CMD Injection||0||0|
|XML Denial of Service (XDoS)||0||0|
|XML Message Validation||0||0|
|Web Services Interoperability||0||0|
|XML SQL Injection||0||0|
|XML Cross-Site Scripting||0||0|
|SOAP Fault Violations||0||0|
|XML Generic Violations||0||0|
|HTML/XML/JSON Log Statistics||Rate (/s)||Total|
|Start URL logs||0||0|
|Deny URL logs 0||0|
|Referer header logs||0||0|
|Buffer overflow logs||0||0|
|Cookie consistency logs||0||0|
|Cookie hijacking logs||0||0|
|CSRF form tag logs||0||0|
|HTML XSS logs||0||0|
|HTML XSS transform logs||0||0|
|HTML SQL Injection logs||0||0|
|HTML SQL transform logs||0||0|
|Field format logs||0||0|
|Field consistency logs||0||0|
|Credit card transform logs||0||0|
|Safe object logs||0||0|
|Content Type logs||0||0|
|JSON Denial of Service logs||0||0|
|JSON SQL injection logs||0||0|
|JSON Cross-Site Scripting logs||0||0|
|File upload types logs||0||0|
|Infer Content Type XML Payload L||0||0|
|HTML Command Injection logs||0||0|
|XML Format logs||0||0|
|XML Denial of Service(XDoS) logs||0||0|
|XML Message Validation logs||0||0|
|XML SQL Injection logs||0||0|
|XML XSS logs||0||0|
|XML Attachment logs||0||0|
|SOAP Fault logs||0||0|
|XML Generic logs||0||0|
|Total log messages||0||0|
|Server Error Response Statistics Rate (/s)||Total|
|HTTP Client Errors (4xx Resp)||0||0|
|HTTP Server Errors (5xx Resp)||0||0|
Viewing HTML command injection statistics by using the Citrix ADC GUI
Complete the following steps to view the command injection statistics:
- Navigate to Security > Citrix Web App Firewall > Profiles.
- In the details pane, select a Web App Firewall profile and click Statistics.
- The Citrix Web App Firewall Statistics page displays the HTML command injection traffic and violation details.
- You can select Tabular View or switch to Graphical View to display the data in a tabular or graphical format.
HTML command injection traffic statistics
HTML command injection violation statistics
HTML command injection protection check
In this article
- How command injection protection works
- Keywords and special characters denied for command injection check
- Configuring command injection check by using the CLI
- Configuring relaxation rules for command injection protection check
- Configuring command injection check by using Citrix ADC GUI
- Viewing command injection traffic and violation statistics
- Viewing HTML command injection statistics by using the Citrix ADC GUI