How do I create an AWS WAF rule to prevent SQL injection and XSS attacks?

Short description

To help prevent SQL injection and XSS attacks, use one of the following protections:

• Built-in SQL injection and XSS engines
• AWS Managed Rules for SQL injection and XSS injection attacks

Note: AWS WAF has maximum size inspection quotas for request bodies, headers, and cookies. For more information, see Oversize web request components in AWS WAF.

Resolution

Note: It's a best practice to test rules in a non-production environment with the Action set to Count. Use Amazon CloudWatch metrics on your AWS WAF logs to evaluate the rule. After you test the rules, change the Action to Block.

Use built-in SQL injection and XSS engines

Attacks can occur on different parts of the HTTP request, such as the HTTP header, query string, or URI. To inspect different parts of the HTTP request against the built-in mitigation engines, configure your AWS WAF rules.

To inspect for malicious SQL code, create a SQL injection attack rule statement. To inspect for malicious scripts in a web request component, create an XSS attack rule statement.

Create a SQL injection or an XSS attack rule statement

Complete the following steps:

1. Open the AWS WAF console.
2. In the navigation pane, under AWS WAF, choose Protection packs (web ACLs).
3. Select your protection pack.
4. Choose Manage rules and then, choose Add rule.
5. Select Custom rule and then, choose Next.
6. Select Custom rule again and then, choose Next.
7. Use the following options for your rule:
   For Action select BLOCK.
   For Rule name, enter a name for your rule.
   For If a request, select Matches the statement.
   For Inspect, select the request components that you want the rule statement to evaluate.
   For Match Type, select Contains SQL injection attacks or Contains XSS injection attacks.
   (Optional) Choose a text transformation.
8. Choose Add Rule.

Create a SQL injection or an XSS attack rule statement that evaluates against multiple request components

Complete the following steps:

1. Open the AWS WAF console.
2. In the navigation pane, under AWS WAF, choose Protection packs (web ACLs).
3. Select your protection pack.
4. Choose Manage rules and then, choose Add rule.
5. Select Custom rule and then, choose Next.
6. Select Custom rule again and then, choose Next.
7. Use the following options for your rule:
   For Action, select BLOCK.
   For Rule name, enter a name for your rule.
   For If a request, choose matches at least one of the statements (OR).
   For Inspect, select the request components that you want the rule statement to evaluate.
   For Match Type, select Contains SQL injection attacks or Contains XSS injection attacks.
   (Optional) Choose a text transformation.
   Under Statement 2, for Inspect, select the request components that you want the rule statement to evaluate.
   For Match Type, select Contains SQL injection attacks or Contains XSS injection.
   (Optional) Choose a text transformation.
8. Choose Add Rule.

Note: For the rule to work, you must apply the correct text transformations. For example, if you want AWS WAF to inspect a cookie, then use URL Decode, HTML entity decode, and Lowercase.

Use AWS Managed Rules for SQL injection and XSS injection attacks

To protect against application vulnerabilities or other unwanted traffic but not write your own rules, use AWS Managed Rules for AWS WAF.

Note:

• Managed rule group providers might update the rule group or let it expire. For more information, see Using versioned managed rule groups in AWS WAF.
• Before you use a managed rule group in production, test it in a non-production environment to mitigate false positives.

To protect against SQL injection attacks, use the SQL database managed rule group . To protect against XSS injection attacks, use the core rule set (CRS) managed rule group .

Add an AWS Managed Rules rule group to your web ACL

Complete the following steps:

1. Open the AWS WAF console.
2. In the navigation pane, under AWS WAF, choose Protection packs (web ACLs).
3. Select your protection pack.
4. Choose Manage rules and then, choose Add rule.
5. Select AWS-managed rule group and then, choose Next.
6. Choose SQL database or Core rule set rule group.
7. After you update the details for your rule, choose Add rule.
   Note: To use an existing AWS Managed Rules rule group, choose the Managed Rule group and edit the details. For more information, see Working with managed rule groups.

Related information

Getting started with AWS WAF using the new console experience

Testing and tuning your AWS WAF protections