HTTP QUERY Method: The Grey Zone Between GET And POST., (Fri, Sep 18th)
The Internet Storm Center highlights a newly defined HTTP method, ‘QUERY’, which sits between GET and POST, and poses a significant security risk due to existing security controls (WAFs, CSRF middleware, etc.) not being prepared to handle it. Because QUERY is cacheable and safe by design, it can be used to bypass existing security measures, particularly in scenarios involving malicious payloads. The risk is low in terms of malware, as behavioral analysis is unaffected by the HTTP method itself, but a proactive approach to updating security rules is crucial.
The Internet Storm Center has identified a new HTTP method, ‘QUERY’, defined in RFC 10008, that presents a growing security challenge. QUERY is designed to function as a GET request with a body, effectively bridging the gap between GET and POST methods. Existing security controls, such as Web Application Firewalls (WAFs) and CSRF middleware, are often built around a predefined set of HTTP verbs (GET, POST, PUT, DELETE, PATCH) and therefore are not equipped to handle this new method.
Researchers have found that popular web servers like nginx and Django reject QUERY requests outright, while tools like curl, FastAPI, Caddy, and Traefik pass it through without issue. This inconsistency creates a vulnerability: a malicious payload can be delivered through QUERY while being blocked by POST-based security measures. Because QUERY is cacheable and safe by design, it can be used to poison caches and bypass CSRF protections.
For example, sending a malicious payload via QUERY can bypass WAF signatures designed to detect SQL injection or XSS attacks that rely on POST bodies. The risk to malware is relatively low because behavioral analysis – the core of many modern Security Operations Center (SOC) defenses – is independent of the HTTP method used. Techniques like RITA/AC-Hunter and TLS fingerprinting are not affected by QUERY.
To mitigate this risk, organizations should proactively update their rules and regexes to support the new verb: `http.method in (“GET”, “POST”, “QUERY”)`. It’s important to note that while QUERY is currently rare in logs, its adoption is expected to increase over time.
[1] https://www.rfc-editor.org/info/rfc10008/ [2] https://dev.to/alexgeorgiev17/nginxs-limitexcept-block-silently-rejects-the-new-http-query-method-1gcg