By mutating innocuous elements such as boundary delimiters in multipart/form-data, character sets in application/json, or namespace features in application/xml, the attack convinces a WAF that a request is benign while the downstream web framework faithfully reconstructs and executes the embedded exploit code. The researchers validated 1,207 unique bypasses across AWS WAF, Azure WAF, Google Cloud Armor, Cloudflare WAF, and ModSecurity, confirming that every mainstream parsing model could be fooled in at least one configuration. WAFFLED exploits parsing differences between WAFs and applications to bypass security filters. In this cut-down proof-of-concept, Cloudflare’s parser stops at the first fake boundary, sees only harmless data, and forwards the request. WAFFLED reminds defenders that security devices must not only look at every byte but also agree on what each byte means. Flask, however, honors the RFC 2231 parameter continuation, concatenates the real boundary, and dutifully executes the XSS payload. AWS WAF’s stricter parser escaped the test suite unscathed, underscoring that meticulous RFC compliance is an effective—if performance-intensive defense.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 18 Jul 2025 09:05:19 +0000