是否可以在 AWS WAF 中添加安全 URL？

Question

I know that AWS WAF is pretty dumb and non-configurable, but last time it becomes stricter.

We can't send even request to backend like:

POST https://our.url/page_id

{
    "data": "<a></a>"
}

In this case awswaf:managed:aws:core-rule-set:CrossSiteScripting_Body_RC_COUNT rule will be triggered.

I tried to find any ways how core-rule-set may be customized, but looks like it is impossible. But I want to trust that is my lack of search and it may be customized in some way. If not, current WAF is simply unusable. I can't imagine case when it may be used with these strict non-editable standard rules.

So the question is: Is it possible to set some safe domains (like https://our.url ) that will be passed without blocking? Or maybe some ways to allow <a> tag for example?

Answer 1

You can customize the action on the AWS managed rule in this way:

• Edit the AWS managed core set and change the rule action to: "Override to Count". Take note of the aws label for this rule (something like "awswaf:managed:aws:core-rule-set:CrossSiteScripting_Body")
• Create a new rule that you add the end of all existing rules. This new rule should trigger on conditions (1) Statement "has a label", where you specify the above label (2) url matches the url you want to let through. Specify the action as "Allow"
• Create a new rule that you add after the previous rule. This rule should trigger on same condition (1). Specify the action as "Block"

Answer 2

Based on @Chris answer:

1. Add AWSManagedRulesCommonRuleSet and override Action to Count for desired Rule ( CrossSiteScripting_BODY in my case) (if you have to allow safe URLs inside query parameters, CrossSiteScripting_QUERYARGUMENTS should be changed same way, etc.)
2. Add custom rule allow-safe-URLs with Block action that will block all requests with CrossSiteScripting_BODY label and with JSON body that don't match <[ ]*a[\-_a-zA-Z0-9 ='"()]*href[ ]*=[ "']https:\/\/([a-zA-Z0-9\-]+\.)?example\.com[ "']*>*.<[ ]*\/[ ]*a[ ]*> RegEx. (only <a href=https://example.com>xxx</a> or <a href=https://anysubdomain.example.com>xxx</a> will be detected as safe)
3. Last default action should be Allow .

Final JSON of the WEB ACL will be looks like:

{
  "Name": "test-waf",
  "Id": "some-uuid-of-web-acl",
  "ARN": "arn:aws:wafv2:us-east-1:1234567890:regional/webacl/test-waf/some-uuid-of-web-acl",
  "DefaultAction": {
    "Allow": {}
  },
  "Description": "Web ACL for URL whitelisting tests",
  "Rules": [
    {
      "Name": "AWS-AWSManagedRulesCommonRuleSet",
      "Priority": 0,
      "Statement": {
        "ManagedRuleGroupStatement": {
          "VendorName": "AWS",
          "Name": "AWSManagedRulesCommonRuleSet",
          "Version": "Version_1.5",
          "RuleActionOverrides": [
            {
              "Name": "CrossSiteScripting_BODY",
              "ActionToUse": {
                "Count": {}
              }
            }
          ]
        }
      },
      "OverrideAction": {
        "None": {}
      },
      "VisibilityConfig": {
        "SampledRequestsEnabled": true,
        "CloudWatchMetricsEnabled": true,
        "MetricName": "AWS-AWSManagedRulesCommonRuleSet"
      }
    },
    {
      "Name": "allow-safe-URLs",
      "Priority": 1,
      "Statement": {
        "AndStatement": {
          "Statements": [
            {
              "NotStatement": {
                "Statement": {
                  "RegexMatchStatement": {
                    "RegexString": "<[ ]*a[\\-_a-zA-Z0-9 ='\"()]*href[ ]*=[ \"']https:\\/\\/([a-zA-Z0-9\\-]+\\.)?example\\.com[ \"']*>*.<[ ]*\\/[ ]*a[ ]*>",
                    "FieldToMatch": {
                      "JsonBody": {
                        "MatchPattern": {
                          "All": {}
                        },
                        "MatchScope": "VALUE",
                        "InvalidFallbackBehavior": "EVALUATE_AS_STRING",
                        "OversizeHandling": "MATCH"
                      }
                    },
                    "TextTransformations": [
                      {
                        "Priority": 0,
                        "Type": "NONE"
                      }
                    ]
                  }
                }
              }
            },
            {
              "LabelMatchStatement": {
                "Scope": "LABEL",
                "Key": "awswaf:managed:aws:core-rule-set:CrossSiteScripting_Body"
              }
            }
          ]
        }
      },
      "Action": {
        "Block": {}
      },
      "VisibilityConfig": {
        "SampledRequestsEnabled": true,
        "CloudWatchMetricsEnabled": true,
        "MetricName": "allow-safe-URLs"
      }
    }
  ],
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "test-waf"
  },
  "Capacity": 707,
  "ManagedByFirewallManager": false,
  "LabelNamespace": "awswaf:1234567890:webacl:test-waf:"
}

---

WARNING : this JSON is just a simple reproducible example (Proof of concept). And this configuration vulnerable for attacks with body like: <a href=https://example.com></a><a href=https://www.evil-url.com></a> . RegEx also may be vulnerable. You have to check if ONLY safe URLs included in body. Actual checking (URL-matching) logic should be more complicated. Don't use it as is (by copy/paste).