Description
To help us diagnose issues efficiently, please include:
[x] A short but descriptive title
[x] A detailed description of the problem including relevant software versions and steps to reproduce
Our service provider uses Cloudflare WAF in front of the VCD. When creating the resources with terraform vcd provider, its PUT calls trigger multiple WAF rules (see below). The same calls from VCD web client don't.
We have compared the calls made by terraform and those made by the web client. The XML format differs slightly, the most obvious difference is dat terraform / govcd starts the request body with an XML preamble (<?xml version="1.0" encoding="UTF-8"?> / <?xml version="1.0" encoding="UTF-8" standalone="yes"?>) while the web client doesn't.
Reproducing the terraform call manually without the preamble doesn't trigger the WAF rules.
Reproducing the web client's call manually with the preamble triggers the WAF rules.
[x] A fix or workaround if you know it
Our current workaround is to have the service provider add exception rules to cloudflare config based on request method (PUT), path, user_agent, request's country of origin. But they are hesitant to making the exceptions too open and we have to negotiate each path prefix separately.
Could go-vcloud-director be configured not te send the XML preamble with the API calls, since it isn't required by the API?
The triggered Cloudflare WAF rules:
960032 · Method is not allowed by policy OWASP HTTP Policy Log
960010 · Request content type is not allowed by policy OWASP HTTP Policy Log
960024 · Meta-Character Anomaly Detection Alert - Repetative Non-Word Characters OWASP Generic Attacks Log
981318 · SQL Injection Attack: Common Injection Testing Detected OWASP SQL Injection Attacks Log
981245 · Detects basic SQL authentication bypass attempts 2/3 OWASP SQL Injection Attacks Log
981243 · Detects classic SQL injection probings 2/2 OWASP SQL Injection Attacks Log
973338 · XSS Filter - Category 3: Javascript URI Vector OWASP XSS Attacks Log
973301 · XSS Attack Detected OWASP XSS Attacks Log
973304 · XSS Attack Detected OWASP XSS Attacks Log
973335 · IE XSS Filters - Attack Detected OWASP XSS Attacks Log
973333 · IE XSS Filters - Attack Detected OWASP XSS Attacks Log
973332 · IE XSS Filters - Attack Detected OWASP XSS Attacks Log