UPDATE (9/28/2014): Our security team indicates that we're now seeing the majority of attempted exploits of Shellshock coming in through input paramters. They've provided ASM signatures to mitigate and recommend customers use these signatures to protect their applications. You can find these signatures and more information in this post: https://devcentral.f5.com/articles/bash-shellshock-mitigation-using-asm-signatures
I had a great conversation this morning with Tom Spector, Enterprise Network Engineering Lead for Security here at F5, about the ways in which customers can use BIG-IP Application Security Manager (ASM) to mitigate Shellshock.
As you're no doubt aware, the potential exploits of Shellshock continue to evolve and we're seeing both HTTP header and input fields used as a transport mechanism for this Bash vulnerability. Web application firewalls (WAF) are a well known tool for protecting applications both on inbound (request) and the outbound (response) across headers and payloads. In the case of Shellshock, BIG-IP ASM is able to provide protection regardless of whether the HTTP method is POST or GET.
Tom offered the following suggestions when using ASM to mitigate Shellshock.
Character Restrictions
Restrict the character ‘{‘ in HTTP headers. Unlike parentheses that are commonly used in headers the character ‘{‘ is not as commonly used (although there may be cases when it is).
To do this in BIG-IP ASM:
- Ensure that under the blocking settings (Security -> Application Security -> Blocking -> Settings) you have checked for learn/alarm/block the violation for ‘Illegal meta character in header’ (found under ‘Input Violations’ section)
- Disallow the characters ‘{‘ in the header character set configuration (Security -> Application Security -> Headers -> Character Set)
- Save and apply the policy
You can also restrict the characters ‘(‘, ‘)’, and ‘{‘ in parameter values. These characters are not typically found in parameter values (some restrictions apply such as phone numbers that include parentheses in the values).
To do this in BIG-IP ASM:
- Ensure that under the blocking settings (Security -> Application Security -> Blocking -> Settings) you have checked for learn/alarm/block the violation for ‘Illegal meta character in value’ (found under ‘Input Violations’ section)
- By default, ASM already disallows the characters ‘(‘, ‘)’, and ‘{‘ in parameter values. You can verify this by looking at the parameter value character set configuration (Security -> Application Security -> Parameters -> Character Set -> Parameter Value)
- Save and apply the policy
Signatures
Ensure all signatures relevant to your environment are enabled (and are not in staging as is any parameter you wish to protect). A few signatures are aimed at identifying shell command injections included in headers or parameters. While this does not target the Shellshock initial attack vector (using the “() {“ sequence) it does handle the injection portion of the attack, i.e. bash commands included after the sequence such as netcat and telnet.
Additionally, consider adding these ASM signature to your arsenal: https://devcentral.f5.com/articles/bash-shellshock-mitigation-using-asm-signatures per our security team's recommendation.
Cookies
One of the headers that may be targeted is Cookie. Using cookie encryption and/or ASM cookie enforcement will restrict any cookie tampering and catch those attempts to manipulate the cookie header of an application.
Please ensure you carefully evaluate the potential impact these changes can have in terms of false positives. In some cases the characters ‘(‘, ‘)’, and ‘{‘ are used in a legitimate manner within an application and blocking them my cause valid traffic to be denied. As patches for vulnerable systems are available, make plans to roll them out as soon as possible.
We will continue to update mitigations and provide additional guidance on mitigating Shellshock as they become available. You can always find the latest information regarding Shellshock on f5.com/shellshock.
Stay safe.