Modify the WAF Policy to Resolve an App Issue

1. In Firefox, open a new tab, then click the Arcadia Finance (N+) bookmark or navigate to https://nginx-plus.arcadia-finance.io/.

2. You should see a partially blank page load as shown below.

3. Now, click on the Arcadia Finance (DIY) bookmark or navigate to https://diy.arcadia-finance.io/.

4. Notice that this page includes more images than the Arcadia Finance (N+) page.

5. Load the Arcadia Finance (N+) bookmark again. Now, we will make a request for the missing image in the blank section of the web page. In your Jump Server RDP session, click Applications and then Terminal.

6. In the terminal window that opens, enter the command below.

curl -X POST -k -H "host: nginx-plus.arcadia-finance.io" "https://nginx-plus-1.appworld.lab/images/slider/slide-img-3.jpg" |& sed 's/>/>\n/gI'

7. NGINX App Protect intercepted the request and responded with this custom page. Notice that a support ID is generated in the terminal output. You can use this ID to identify the cause of the image block. Select and copy this value so that you can search for it in SM.

8. Return to NIM and navigate to Security Monitoring by clicking the drop-down in the top left of the screen and selecting Security Monitoring.

9. You’ll be presented with the Security Monitoring landing page, as shown below:

10. On the left menu, select Support ID Details.

11. You’ll be prompted for your support ID.

12. Enter your support ID into the search field and click the arrow to search. If you receive an error, the system is still processing the alert; wait a bit and click Try Again.

Note

At anytime in this lab you encounter a support ID, feel free to return to this tool to look at the details of the attack and mitigation.

13. Once the security event has loaded, you can see details surrounding the violation that is blocking images on your app.

14. Notice that the image URI is listed as /images/slider/slide-img-3.jpg.

15. If you scroll down to the Attack Details section, you can expand the individual sections showing Violations, Subviolations, CVEs, and Threat Campaigns.

16. Notice that the Violations section shows an Illegal File Type violation.

17. You need to allow JPG files to enable the application to operate properly. To do this, you will need to modify the WAF policy. Start that process by navigating back to Instance Manager from the Select module drop-down at the top of the left menu bar.

18. Inside of the Instance Manager dashboard, click on App Protect, then Policies towards the bottom of the left menu bar.

19. Click on the AppWorldPolicy in the policy list.

20. Now, click on the Versions tab inside of the Policy Detail page.

21. Click on the version name under the Versions column in the list.

22. The JSON configuration of the policy will be displayed, as shown below:

23. To modify the policy based on this version of the policy, click Edit Version.

24. Provide a description of the changes you’ll be making in the Description field.

25. Place your mouse cursor inside the policy editor. Press CTRL+F to open the search dialog.

26. Search for “jpg” and you’ll find on line 240 that JPG files are not being allowed. Modify line 241 to change "allowed": false to "allowed": true. Note that false and true are not encapsulated in quotation marks.

27. Click the Save New Version button to create a new version of the policy.

28. You will see confirmation that the new version has been created.

29. Click on the policy name at the top of the screen.

30. Select the Versions tab.

31. Notice the new policy version is now listed.

32. Return to the the Deployments tab.

33. Now click on the Assign Policy and Signature Versions button above the instance list.

34. Notice that the version listed in the Policy Version column is in a drop-down box. You may need to hover your mouse arrow over this section to see the drop-down appear.

35. Change this to your newer version (compare timestamps) and click Publish.

36. A pop-up will confirm that you have changed the version.

37. Click X to close the confirmation window.

38. Click Cancel to close the assignment window.

39. On the top of the left menu bar, click Instances.

40. Select the nginx-plus-1 instance from the list.

41. Look for the deployment status in the Last Deployment Details section. You should see a status of Successful. If not, wait a few moments for the deployment to commence and complete. You may need to refresh your browser for the status to update.

42. Once the deployment has finished, check the site to see if the issue is remediated. Go back to the Terminal that is open on the Jump Server and enter the command below.

curl -X POST -k -H "host: nginx-plus.arcadia-finance.io" "https://nginx-plus-1.appworld.lab/images/slider/slide-img-3.jpg" -o slide-img-3.jpg && file slide-img-3.jpg | sed 's/, /\n/gI'

The command will attempt to download the jpg image, and inspect its contents. You should see output as in the screenshot below signifying that the file has been downloaded successfully, and is no longer being blocked by the WAF policy.

Now that you have viewed, diagnosed and remedied a false positive in a WAF policy, continue to the next section of the lab.