Double Encoding bypasses WAF

Description
----------------------------------------------------
This attack technique consists of encoding user request parameters twice in hexadecimal format in order to bypass security controls or cause unexpected behavior from the application. its possible because the webserver accepts and processes client requests in your encoded forms.

By using double encoding it's possible to bypass security filters that only decode user input once. the second decoding process is executed by the backend platform or modules that properly handle encoded data, but dont have the corresponding security checks in place.

Attackers can inject double encoding in pathnames or query strings to bypass the authentication schema and security filters in use by the web application.

There are some common characters sets that are used in Web applications attacks. for example, Path Traversal attacks use "... /"(dot-slash), while XSS attacks use" <"and"> "characters. these characters give a hexadecimal representation that differs from normal data.

For example, "... /"(dot-slash) characters represent % 2E % 2E % 2f in hexadecimal representation. when the % symbol is encoded again, its representation in hexadecimal code is % 25. the result from the double encoding process ".. /"(dot-slash) wocould be % 252E % 252E % 252F:

The hexadecimal encoding of "../" represents "% 2E % 2E % 2f"
Then encoding the "%" represents "% 25"
Double encoding of "../" represents "% 252E % 252E % 252F"

Risk Factors
----------------------------------------------------
TBD

Examples
----------------------------------------------------
Example 1
This example presents an old well-known vulnerability found in IIS versions 4.0 and 5.0, where an attacker cocould bypass an authorization schema and gain access to any file on the same drive as the web root directory due to an issue with the decoding mechanic. for more details about folder traversal vulnerability, see CVE 2001-0333.

In this scenario, the victim has a published executable directory (e.g. cgi) that's stored on the same partition as the Windows system folder. an attacker cocould execute arbitrary commands on the web server by submitting the following URL:

Original URL:
Http: // victim/cgi/.../../winnt/system32/cmd.exe? /C + dir + c:
However, the application uses a security check filter that refuses requests containing characters like ".../". By double encoding the URL, it's possible to bypass security the filter:

Double encoded URL:
Http: // victim/cgi/% 252E % 252E % 252F % 252E % 252E % 252 Fwinnt/system32/cmd.exe? /C + dir + c:

Example 2
A double encoded URL can be used to perform an XSS attack in order to bypass a built-in XSS detection module. depending on the implementation, the first decoding process is already med by HTTP protocol and the resultant encoded URL will bypass the XSS filter, since it has no mechanic ISMs to improve detection. A simple example XSS wocould be:
<Script> alert (XSS) </script>
This malicious code cocould be inserted into a vulnerable application, resulting in an alert window with the message "XSS ". however, the web application can have a character filter which prohibits characters such as "<", ">" and "/", since they are used to perform web application attacks. the attacker cocould use a double encoding technique to bypass the filter and exploit the client's session. the encoding process for this Java script is:

Char Hex encode Then encoding % Double encode
"<" "% 3C" "% 25" "% 253C"
"/" "% 2F" "% 25" "% 252F"
">" % 3E "" % 25 "" % 253E"
Finally, the malicious double encoding code is:
% 253 Cscript % 253 Ealert (XSS) % 253C % 252 Fscript % 253E

From: https://www.owasp.org/index.php/Double_Encoding