CVE-2021-45468
📋 TL;DR
This vulnerability allows remote attackers to bypass Imperva Web Application Firewall security controls by using gzip Content-Encoding in HTTP POST requests. Attackers can send malicious payloads to web servers protected by the WAF. Organizations using affected Imperva WAF versions are vulnerable.
💻 Affected Systems
- Imperva Web Application Firewall
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete WAF bypass allowing direct exploitation of web application vulnerabilities (SQL injection, RCE, etc.) on protected servers
Likely Case
Successful evasion of WAF security controls leading to web application attacks that would normally be blocked
If Mitigated
WAF continues to function normally with proper patching or workarounds in place
🎯 Exploit Status
Simple HTTP request manipulation required; detailed technical analysis published by Bishop Fox
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions from 2021-12-23 onward
Vendor Advisory: https://www.imperva.com/support/security-advisories/
Restart Required: Yes
Instructions:
1. Update Imperva WAF to version from 2021-12-23 or later
2. Restart WAF services
3. Verify update through management interface
🔧 Temporary Workarounds
Block gzip Content-Encoding
allConfigure WAF to block or inspect HTTP requests with Content-Encoding: gzip header
Configure via Imperva management interface: Security Policies → HTTP Protocol → Block Content-Encoding: gzip
Disable gzip decompression
allDisable automatic gzip decompression in WAF configuration
Configure via Imperva management interface: Advanced Settings → Disable gzip decompression
🧯 If You Can't Patch
- Implement network-level filtering to block or inspect gzip-encoded POST requests
- Deploy additional WAF layer or enable strict input validation on backend applications
🔍 How to Verify
Check if Vulnerable:
Test by sending gzip-compressed malicious payload in POST request and checking if WAF blocks itCheck Version:
Check version in Imperva management interface or via CLI: show versionVerify Fix Applied:
After patching, test with same gzip-compressed payload - should now be properly inspected and blocked📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests with Content-Encoding: gzip header
- WAF bypass alerts in security logs
- Unusual gzip-encoded traffic patterns
Network Indicators:
- HTTP POST requests with gzip encoding containing suspicious payloads
- Traffic bypassing expected WAF inspection points
SIEM Query:
source="imperva_waf" AND (http_content_encoding="gzip" OR http_method="POST") AND threat_severity>=high