New HTTP QUERY method may bypass WAF rules

IETF's new HTTP QUERY verb can slip past WAF, cache, and CSRF controls that only recognize GET/POST, though no in-the-wild abuse is reported yet.

SANS ISC handler Xavier Mertens examines RFC 10008's new HTTP method, QUERY, which behaves like a GET with a body — safe, idempotent, and cacheable, with a fresh Accept-Query header for content negotiation. It's the first new HTTP verb since PATCH in 2010, and the piece argues the operational risk isn't the RFC itself but that most web security controls (WAF signatures, API-gateway allowlists, CSRF middleware, cache keying, load balancers) hard-code a known verb set of GET/POST/PUT/DELETE/PATCH and have not been updated to account for QUERY.

Testing cited in the article shows inconsistent handling across the ecosystem: nginx's limit_except and Django's View class reject QUERY outright, while curl, FastAPI, Caddy, and Traefik pass it through untouched. Because QUERY carries a request body like POST but is treated as safe/cacheable like GET, several failure modes emerge: WAF rules that only inspect POST bodies for SQLi/XSS/command-injection payloads can be bypassed by sending the same payload via QUERY; caches that don't key on the full request body could serve one user's malicious QUERY payload to another (cache poisoning); and CSRF middleware hardcoded to classic state-changing verbs may wave through QUERY endpoints with unintended side effects. The author found no QUERY traffic yet in his own logs but expects adoption to grow.

For malware/C2 detection, the author notes minimal impact: behavioral detection (beaconing/interval analysis, JA3/JA4 TLS fingerprinting, flow-based analytics) is method-agnostic, and for HTTPS-based C2 the method is inside the encrypted tunnel and invisible to non-intercepting sensors regardless. The practical recommendation for defenders is to update method-matching rules and regexes (e.g., http.method in GET/POST/QUERY) across WAFs, gateways, cache configs, and CSRF logic, and to test whether malicious payloads sent via QUERY are inspected identically to POST.

Source reporting: https://isc.sans.edu/diary/rss/33352