Web Application Firewall Bypassed via JS Injection with Parameter Pollution

In a recent autonomous penetration test, researchers demonstrated a novel cross-site scripting (XSS) bypass that sidesteps even highly restrictive Web Application Firewalls (WAFs). The find involved an ASP.NET application protected by a tightly configured WAF, where conventional XSS payloads were blocked, but injecting across multiple query parameters using HTTP Parameter Pollution allowed syntactically valid JavaScript to slip past detection.

The team showed how ASP.NET’s HttpUtility[.]ParseQueryString() concatenates duplicate parameters with commas, turning a multi-parameter input into a string that JavaScript can execute via the comma operator, effectively bypassing signature-based checks. Seventeen WAF configurations were tested, and bypass rates rose from 17.6% for simple injections to 70.6% for the most complex parameter-pollution payload, with Azure WAF, Google Cloud Armor, and open-appsec performing notably differently.

Azure WAF was found to bypass with an escaped backslash payload, while Google Cloud Armor blocked all three manual payloads, and open-appsec yielded a bypass for its Critical configuration in under 30 seconds. The findings emphasise WAF limitations, the potential of automation, and the ongoing need for defence in depth and secure coding practices.