How do I use AWS WAF to block specific file extension uploads?

Short description

When you analyze the POST data of an HTTP request, uploaded content can be one of two types:

• Form data
• Binary

Note: AWS WAF inspects the first 8 KB (8,192 bytes) of the request body. For information on larger body requests, see Handling oversize web request components in AWS WAF.

To restrict file uploads that use a specific file extension, such as .pdf, .docx, or .exe, complete the following steps:

1. Create a custom web access control list (web ACL) rule to inspect the request BODY.
2. Create a regex match condition within the rule. Use this regex pattern to configure the rule to restrict multiple file extensions.
3. Set the rule action to BLOCK.
4. Define the rule priority so that this custom rule has a higher priority than any web ACL rule that can block this rule.
5. Validate that the rule successfully blocks the specific file extension.

Resolution

Identify the type of content that the POST data uses

The POST data inside HTTP requests typically uses either form data or binary.

• Form data includes any data that a user enters on a web page (or "HTML form") that HTTP sends (or "posts") to a web server.
• A binary payload is anything other than a text payload. For example, a binary payload can be a .jpeg file, a .gzip file, or an .xml file. This includes generic binary data such as from a .pdf application, .jpeg image, or .zip application. For all file extension types, see Media types on the Internet Assigned Numbers Authority (IANA) website.

To identify the type of POST request, see the Content-Type value of the HTTP POST header. The following example contains a Content-Type of multipart/form-data:

Content-Type: multipart/form-data

If the header "Content-Type" has a value of "multipart/form-data" then complete the following steps to create a rule:

1. Open the AWS WAF console.

2. In the navigation pane, under AWS WAF, choose Web ACLs.

3. For Region, choose the AWS Region where you created your web ACL.
   Note: If you set up your web ACL for Amazon CloudFront, then select Global.

4. Select your Web ACL. Then, choose the Rules tab.

5. Choose the Add Rules dropdown list, and then choose Add my own rules and rule groups.

6. For the Rule type, choose Rule Builder.

7. For Name, enter a name to identify this rule.

8. For Type, choose Regular rule.

9. For If a request, choose matches the statement. Then, complete the following fields for the Statement
   For Inspect, choose Body.
   For Content type, choose JSON.
   For JSON match scope, choose Values.
   For How AWS WAF should handle the request if the JSON in the request body is invalid, choose the relevant option for your use case.
   For Content to inspect, choose Full JSON content.
   For Match type, choose Matches regular expression.
   For Regular expression, enter a regex-pattern to match. See the following example:

   (?:.pdf|.doc|.docx|.ppt)

10. (Optional) For Text transformation, you can add a text transformation, or keep these fields as None.

11. For Oversize Handling, choose the relevant option for your use case.

12. For Action, choose Block.

13. Choose Add Rule.

14. (Optional) For Set Rule Priority, select your rule and move its priority. AWS WAF processes the rules in the order that they appear. For more information, see Processing order of rules and rule groups in a web ACL.

15. Choose Save.

Validate that the rule works as expected.

If the header "Content-Type" has a binary value such as "application/pdf" or "application/ppt" then complete the following steps to create a rule:

1. Open the AWS WAF console.

2. In the navigation pane, under AWS WAF, choose Web ACLs.

3. For Region, choose the AWS Region where you created your web ACL. Note: If you set up your web ACL for Amazon CloudFront, then select Global.

4. Select your Web ACL. Then, choose the Rules tab.

5. Choose the Add Rules dropdown list, and then choose Add my own rules and rule groups.

6. For the Rule type, choose Rule Builder.

7. For Name, enter a name to identify this rule.

8. For Type, choose Regular rule.

9. For If a request, choose matches the statement. Then, complete the following fields for the Statement:
   For Inspect, choose Single header.
   For Header field name, enter Content-Type.
   For Match type, choose Matches regular expression.
   For Regular expression, enter a regex-pattern to match.
   See the following example for .pdf and .jpeg files:

   (?:pdf|jpeg) 

10. (Optional) For Text transformation, you can add a text transformation, or keep these fields as None.

11. For Action, choose Block.

12. Choose Add Rule.

13. (Optional) For Set Rule Priority, select your rule and move its priority. AWS WAF processes the rules in the order that they appear. For more information, see Processing order of rules and rule groups in a web ACL.

14. Choose Save.

15. Validate that the rule works as expected.

Note: To restrict the rule for a specific upload URI path, use an AND statement inside the web ACL rule that inspects the path.