New HTTP QUERY method may bypass WAF rules
IETF's new HTTP QUERY verb can slip past WAF, cache, and CSRF controls that only recognize GET/POST, though no in-the-wild abuse is reported yet.
Sourceisc.sans.edu — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
SANS ISC handler Xavier Mertens examines RFC 10008's new HTTP method, QUERY, which behaves like a GET with a body — safe, idempotent, and cacheable, with a fresh Accept-Query header for content negotiation. It's the first new HTTP verb since PATCH in 2010, and the piece argues the operational risk isn't the RFC itself but that most web security controls (WAF signatures, API-gateway allowlists, CSRF middleware, cache keying, load balancers) hard-code a known verb set of GET/POST/PUT/DELETE/PATCH and have not been updated to account for QUERY.
Testing cited in the article shows inconsistent handling across the ecosystem: nginx's limit_except and Django's View class reject QUERY outright, while curl, FastAPI, Caddy, and Traefik pass it through untouched. Because QUERY carries a request body like POST but is treated as safe/cacheable like GET, several failure modes emerge: WAF rules that only inspect POST bodies for SQLi/XSS/command-injection payloads can be bypassed by sending the same payload via QUERY; caches that don't key on the full request body could serve one user's malicious QUERY payload to another (cache poisoning); and CSRF middleware hardcoded to classic state-changing verbs may wave through QUERY endpoints with unintended side effects. The author found no QUERY traffic yet in his own logs but expects adoption to grow.
For malware/C2 detection, the author notes minimal impact: behavioral detection (beaconing/interval analysis, JA3/JA4 TLS fingerprinting, flow-based analytics) is method-agnostic, and for HTTPS-based C2 the method is inside the encrypted tunnel and invisible to non-intercepting sensors regardless. The practical recommendation for defenders is to update method-matching rules and regexes (e.g., http.method in GET/POST/QUERY) across WAFs, gateways, cache configs, and CSRF logic, and to test whether malicious payloads sent via QUERY are inspected identically to POST.
Source reporting: https://isc.sans.edu/diary/rss/33352
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs