Researcher: Juan Felipe Osorio Zapata - JF0x0r
A parsing differential in the Imperva Cloud WAF deep-packet inspection (DPI) engine allows complete evasion of field-specific security rules by substituting hyphens (-) with underscores (_) in sensitive HTTP headers. While the WAF applies signature-based decoding and blocking logic to canonical headers such as X-Forwarded-For, the underscore-delimited variant X_forwarded_for is processed as an opaque user-defined header, bypassing all field-specific inspection routines.
Many backend servers and frameworks (e.g., Nginx, IIS, and others) normalize or semantically interpret the underscored variant as equivalent to the hyphenated canonical form. This creates a tunneling vector: payloads that the WAF is explicitly configured to block in X-Forwarded-For pass unobstructed via X_forwarded_for, where the backend accepts and acts upon them.
This is a CWE-436: Interpretation Conflict between the security control (Imperva WAF) and the downstream consumer (origin server).
Clarification on RFC 7230: RFC 7230 permits both
-and_as valid characters within header field-names. However, it does not mandate semantic equivalence between hyphenated and underscored forms. The vulnerability is not a protocol flaw; it is a product-specific parsing differential. Imperva's engine fails to canonicalize header names before applying field-specific deep inspection, causingX_forwarded_for(and similar variants) to evade security logic that strictly targetsX-Forwarded-For.
The result is a security boundary violation: the WAF enforces policy on one syntactic representation while the backend interprets another representation of identical semantic intent.
The following excerpt from RFC 7230 §3.2.6 confirms that both - and _ are legal token characters in HTTP header field-names, which is the syntactic foundation that makes this bypass possible:
Affected headers exhibiting this behavior include, but are not limited to:
| Canonical Header | Bypass Variant |
|---|---|
X-Forwarded-For |
X_forwarded_for |
X-Original-Url |
X_original_url |
X-Rewrite-Url |
X_rewrite_url |
X-HTTP-Method-Override |
X_http_method_override |
Use the provided scanner to test a target endpoint. It sends paired payloads: one in the standard hyphenated header (STD) and one in the underscore variant (VAR). A classic bypass is flagged when STD=403 (blocked by field-specific rule) and VAR=200 (accepted).
pip install requests urllib3
python3 imperva_header_normalization.py https://target.example/Scanner output — confirmed bypass detection:
Step 1 — Canonical header blocked (HTTP 403):
The WAF correctly intercepts the request when X-Forwarded-For is used with a malicious payload.
Step 2 — Underscore variant bypasses WAF (HTTP 200):
The identical payload delivered via X_forwarded_for reaches the origin server unfiltered.
The same differential was reproducible against Imperva's own support portal, demonstrating the bypass is not target-specific but engine-level.
Step 1 — Canonical header blocked (HTTP 403):
Step 2 — Underscore variant bypasses WAF (HTTP 200):
| Dimension | Detail |
|---|---|
| Affected Product | Imperva Cloud WAF (all tiers) |
| CWE | CWE-436: Interpretation Conflict |
| CVSS v3.1 Base | 8.6 (High) — AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N |
| Attack Vector | Remote, unauthenticated |
| Scope | Any application behind Imperva WAF relying on field-specific header rules |
- IP Spoofing via
X_forwarded_for: Manipulate IP-based access controls, rate limiting, geo-fencing, and audit logs. - Path traversal / SSRF via
X_original_url/X_rewrite_url: Trigger internal routing logic in frameworks that process these headers. - Method override via
X_http_method_override: Invoke restricted HTTP verbs (DELETE, PUT, PATCH) through POST requests on backends that respect this header. - WAF rule nullification: Any field-specific signature rule (SQLi, XSS, RFI in header context) targeting canonical header names is silently defeated.
The following server/framework behaviors make this bypass exploitable end-to-end:
| Backend | Normalization Behavior |
|---|---|
| Nginx | Converts underscores to hyphens in proxied headers when underscores_in_headers on is set; silently drops underscored headers otherwise (attacker controls which path) |
| IIS / ASP.NET | Exposes headers via ServerVariables using underscore-normalized keys (e.g., HTTP_X_FORWARDED_FOR), making both forms equivalent at the application layer |
| PHP | $_SERVER keys are uppercased and hyphens replaced with underscores — X-Forwarded-For and X_forwarded_for both map to HTTP_X_FORWARDED_FOR |
| Apache mod_proxy | Passes headers as-is; application frameworks perform normalization downstream |
| Node.js / Express | Header names are lowercased; libraries that normalize separators treat both forms identically |
- Canonicalize header field-names before applying field-specific deep inspection rules — normalize both
-and_to a single representation at the DPI layer. - Update signature matching to apply header-based rules to all syntactic variants of a target header, not just the canonical RFC form.
- Audit all field-specific rules for equivalent bypass exposure across other header normalization dimensions (case folding, whitespace, encoded characters).
Until a vendor patch is available, the following mitigations reduce exposure:
# Nginx — deny underscore headers at the edge
underscores_in_headers off; # default — drops headers with underscores
ignore_invalid_headers on; # drop malformed/unknown headers# Apache — strip non-standard headers before proxying
RequestHeader unset X_Forwarded_For
RequestHeader unset X_Original_Url
RequestHeader unset X_Rewrite_Url
RequestHeader unset X_Http_Method_Override- Custom WAF rules: Add explicit rules for underscore variants of all sensitive headers.
- Allowlist known headers: Drop any header not in an explicitly approved list at the ingress layer.
- Audit application logic: Ensure backend code does not act on underscored header variants without sanitization.
| Date | Event |
|---|---|
| 23 Feb 2026 | Vulnerability discovered and reported via authorized bug bounty platform. |
| 23 Feb 2026 | Bugcrowd triage responds: "Unable to identify immediate security impact" — marked Not Applicable. |
| 28 Feb 2026 | Direct outreach to Imperva security researcher Yohan Sillam (LinkedIn). |
| 19 Mar 2026 | Follow-up outreach to Imperva security researcher Daniel Johnston (LinkedIn). |
| Apr 2026 | Imperva silently deploys a fix to the affected customer's managed WAF instance without acknowledging the report or issuing a public advisory. |
| Apr 2026 (Current) | Public disclosure initiated. CVE ID request submitted to MITRE. |
- [1] RFC 7230 §3.2.6 — HTTP/1.1 Message Syntax and Routing: Header Fields token grammar — https://datatracker.ietf.org/doc/html/rfc7230
- [2] CWE-436: Interpretation Conflict — https://cwe.mitre.org/data/definitions/436.html
- [3] Nginx
underscores_in_headersdirective — https://nginx.org/en/docs/http/ngx_http_core_module.html#underscores_in_headers - [4] OWASP HTTP Request Smuggling — https://owasp.org/www-community/attacks/HTTP_Request_Smuggling
- [5] PortSwigger — Bypassing WAFs with HTTP header smuggling
Juan Felipe Osorio Zapata - JF0x0r
Independent Security Researcher
Focused on web application security, Android Hacking, Code Review, WAF evasion techniques, and protocol-level parsing differentials.
This research was conducted responsibly under coordinated disclosure principles. All testing was performed on authorized environments or Imperva's own infrastructure.