Technical Tip: Configure protection against prototype pollution attacks in FortiWeb

Prototype pollution is a JavaScript vulnerability where an attacker can modify an object's prototype to inject or modify properties across all objects in an application, allowing to attacker bypass security controls, cause Denial of Service (DoS), generate cross-site scripting (XSS) attacks, among other things. To protect against this type of attack with FortiWeb, a custom signature can be configured.

1. Go to Web Protection -> Known Attacks -> Custom Signature. Select Custom Signature and then select 'Create New':

2. In New Custom Signature, configure the following:

• Name: Use any name (Preferably not using spaces).
• Action: Alert and deny.

Leave all other fields without changes. After that, select OK.

3. Select 'Create New':

4. In New Custom Signature Meet Condition Rule, configure the following settings:

• Match Operator: Regular expression match
• Case Sensitive: Disable
• Regular Expression: \b(__proto__|constructor\.prototype|prototype)\b

5. In the Available Target column, select 'Parameter Name' and 'Parameter Value', and then select the right arrow to pass these values to Selected Target. After that, select OK:

6. Configured values will appear in the Custom Signature Meet Condition Rule list. To finish this part, select OK:

7. Select Custom Signature Group and select 'Create New':

8. Under Name, use any name (preferably not using spaces). Then, select OK:

9. Select Create New:

10. In New Signature Group Member -> Custom Signature, search and select the signature created in points 1-6. After that, select OK:

11. In Edit Custom Signature Group, select OK:

12. Go to Web Protection -> Known Attacks -> Signatures and select the signatures profile used in the server policy (or create a new one if there is none). Select it and then select Edit (or perform a double-click in the signature profile):

13. In Edit Signature Policy, under Custom Signature Group, select the custom signature group created in point 7-11. After that, select OK:

Related information:

• Defining custom data leak & attack signatures