New HTTP QUERY Method Poses Security Risks to Unprepared Web Infrastructure
The recently standardized HTTP QUERY method, designed as a 'GET with a body,' introduces significant security risks due to its potential to bypass existing web security controls.
The Internet Engineering Task Force (IETF) introduced a new HTTP method, 'QUERY,' in RFC 10008 earlier this year, marking the first new standard HTTP verb since 'PATCH' in 2010. This method is described as a 'GET with a body,' offering the safety and idempotency of GET requests while allowing data to be sent in the request body, similar to POST. It is explicitly cacheable, and servers indicate their supported body formats via an 'Accept-Query' header.
The primary security concern surrounding the QUERY method lies in its novelty. Existing web security infrastructure, including Web Application Firewalls (WAFs), API gateways, CSRF middleware, and caching mechanisms, were built around the established set of HTTP verbs like GET, POST, PUT, and DELETE. These systems often rely on pattern matching or specific handling logic for these known methods. The introduction of QUERY, which combines characteristics of GET and POST, can lead to unexpected behavior and bypasses if these controls are not explicitly updated to recognize and properly handle this new verb.
Researchers have observed inconsistent handling of the QUERY method across various web servers and frameworks. For instance, while some systems like curl, Caddy, and Traefik pass QUERY requests through without issue, others like nginx's 'limit_except' pattern and Django's View class reject it outright. This inconsistency means that security policies applied to POST requests might not be enforced for identical requests sent via QUERY, creating exploitable gaps.
One significant risk is the bypass of security signatures designed to detect malicious payloads in POST requests. If a WAF's SQL injection or XSS detection rules are only configured to inspect the body of POST requests, a QUERY request carrying the same malicious payload could pass through undetected. This allows attackers to easily test and exploit such vulnerabilities by simply changing the HTTP method.
Furthermore, the cacheable nature of the QUERY method, combined with caching systems that do not meticulously inspect the entire request body for cache keying, opens the door to cache poisoning attacks. A malicious QUERY request could be cached and subsequently served to other users, potentially delivering harmful content or session hijacking tokens. Similarly, CSRF middleware that is hardcoded to protect against state-changing verbs like POST might fail to protect endpoints that use QUERY for unintended side effects.
While the QUERY method is not yet widely adopted, its potential for misuse is evident. Network security sensors that do not perform deep packet inspection and TLS decryption will not be able to differentiate between GET, POST, and QUERY requests, rendering them ineffective against method-specific bypasses. However, for HTTPS traffic, where the HTTP method is encrypted within the TLS tunnel, network sensors without decryption capabilities are blind to the method anyway. The impact is most pronounced for security controls operating at the application layer that rely on explicit HTTP method handling.
Organizations defending web infrastructure should proactively update their security policies and configurations to explicitly recognize and handle the QUERY method. This includes updating WAF rules, API gateway policies, CSRF protection mechanisms, and caching strategies to account for this new HTTP verb. Failure to do so could leave systems vulnerable to bypasses and attacks that leverage the 'grey zone' between GET and POST.
While behavioral detection methods for Command and Control (C2) traffic, such as connection frequency, timing, and volume analysis, are generally agnostic to the HTTP method used, specific application-layer security controls that rely on method-based filtering are directly impacted. The security community anticipates that as adoption of the QUERY method grows, so too will the exploitation of these unprepared systems.