CVE-2024-56523: Radware Cloud WAF Auth Bypass Vulnerability

CVE-2024-56523 Overview

CVE-2024-56523 is a critical HTTP Request Smuggling vulnerability affecting Radware Cloud Web Application Firewall (WAF) versions prior to the 2025-05-07 patch. Remote attackers can bypass firewall filters by placing random data in the HTTP request body when using the HTTP GET method, effectively circumventing security protections designed to filter malicious traffic.

Critical Impact

This vulnerability allows remote attackers to completely bypass WAF security filters, potentially exposing backend applications to attacks that the WAF is intended to block, including SQL injection, XSS, and other web application attacks.

Affected Products

• Radware Cloud WAF (all versions before 2025-05-07)
• Cloud-based web application firewall deployments using Radware infrastructure
• Organizations relying on Radware Cloud WAF for perimeter security

Discovery Timeline

• 2025-05-12 - CVE CVE-2024-56523 published to NVD
• 2025-07-01 - Last updated in NVD database

Technical Details for CVE-2024-56523

Vulnerability Analysis

This vulnerability is classified under CWE-444 (Inconsistent Interpretation of HTTP Requests), commonly associated with HTTP Request Smuggling attacks. The flaw exists in how the Radware Cloud WAF processes HTTP GET requests that contain data in the request body.

While the HTTP/1.1 specification does not explicitly prohibit sending a body with GET requests, it is considered semantically meaningless and most servers ignore it. The Radware Cloud WAF exploits this ambiguity incorrectly—when random data is placed in the body of an HTTP GET request, the WAF fails to properly inspect the entire request, allowing malicious payloads to pass through undetected.

This bypass mechanism enables attackers to smuggle malicious content past the WAF's filter rules by crafting GET requests with payloads embedded in the request body rather than in URLs or headers where the WAF would typically inspect them.

Root Cause

The root cause stems from inconsistent handling of HTTP GET requests containing body content. The Radware Cloud WAF's request parsing logic does not properly account for the edge case where GET requests include body data, creating a blind spot in the security inspection pipeline. This parsing inconsistency allows attackers to craft specially formed requests that evade the filter rules entirely.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending HTTP GET requests to target applications protected by Radware Cloud WAF, with malicious payloads placed in the request body rather than the URL or headers.

The attack flow involves:

1. Identifying a target application protected by Radware Cloud WAF
2. Crafting an HTTP GET request with attack payloads (such as SQL injection or XSS) placed in the request body
3. Sending the malformed request through the WAF
4. The WAF fails to inspect the body content of GET requests, allowing the malicious payload to reach the backend application
5. Backend applications that process GET request bodies become vulnerable to the smuggled attack

For technical details on HTTP Request Smuggling vulnerabilities and exploitation techniques, refer to the CERT Vulnerability Advisory #722229.

Detection Methods for CVE-2024-56523

Indicators of Compromise

• Unusual HTTP GET requests containing body content in web server access logs
• Increased volume of GET requests with Content-Length or Transfer-Encoding headers
• Backend application security alerts for attacks that should have been blocked by the WAF
• Evidence of successful SQL injection, XSS, or other web attacks despite WAF protection

Detection Strategies

• Monitor for HTTP GET requests with non-zero Content-Length headers in access logs
• Implement backend application-layer detection for common attack patterns as a secondary defense
• Deploy log analysis rules to identify anomalous GET request patterns with body content
• Use network traffic analysis tools to inspect raw HTTP traffic for malformed GET requests

Monitoring Recommendations

• Enable detailed logging on backend web servers to capture full request details including body content
• Configure SIEM rules to alert on GET requests with body data targeting protected applications
• Implement behavioral analysis to detect sudden changes in request patterns that may indicate exploitation attempts
• Review WAF bypass indicators by comparing backend application security alerts against WAF logs

How to Mitigate CVE-2024-56523

Immediate Actions Required

• Verify that your Radware Cloud WAF deployment has been updated with patches released on or after 2025-05-07
• Contact Radware support to confirm your cloud WAF instance is running the patched version
• Implement additional backend security controls as defense-in-depth while verifying patch status
• Review access logs for evidence of exploitation attempts using GET requests with body content

Patch Information

Radware has addressed this vulnerability in their Cloud WAF service with updates deployed on 2025-05-07. As this is a cloud-managed service, patches should be automatically applied to customer deployments. However, organizations should verify with Radware that their specific deployment has received the security update.

For more information about Radware Cloud Security services and updates, visit the Radware Cloud Security Overview.

Workarounds

• Configure backend web servers to reject or log GET requests that contain body content
• Implement additional WAF rules at the application layer to inspect GET request bodies
• Deploy secondary security controls such as application-level input validation
• Consider using a secondary WAF or security proxy as an additional inspection layer until the patch is confirmed

# Example: Apache configuration to log GET requests with body content
# Add to httpd.conf or relevant virtual host configuration
SetEnvIf Request_Method "GET" is_get_request
SetEnvIf Content-Length ".+" has_content_length
CustomLog "/var/log/httpd/suspicious_get.log" combined env=is_get_request,has_content_length