Thread Info
  • State Not Answered
  • +2 person also asked this people also asked this
  • Locked Locked
  • Replies 16 replies
  • Subscribers 40 subscribers
  • Views 4306 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Web Filter Bypass Issue with URL Groups

haydenspence

Hello.

I've come across a minor issue with the Web Filter where a user may still be able to load a webpage, even though it is 'blocked.'

Running the latest version of XG firewall (18.0.4 MR-4).

To replicate:

1. Create a URL group and add a domain, for example: example.com

2. Create a User Activity with the URL group added.

3. Create a web filter Policy, denying the above created User Activity.

4. Apply the web filter Policy to a firewall rule.

On a PC impacted by the firewall rule, load the URL with a period (.) at the end of the URL. For example: http://example.com.

Without the period at the end of the URL, the webpage is blocked (as expected). With the period, it loads in full.

One more thing, the PC points to the XG for DNS.

Is anyone else able to replicate this issue?



This thread was automatically locked due to age.
Parents Reply
  • 0 in reply to haydenspence

    Hello Hayden,

    Thank you, I would try to bring this to the attention of GES, I was somewhat able to replicate, for a moment the behavior was the one mentioned in the post, but after a 2nd or 3rd try the site would remain blocked, even after clearing cookies or cache, or staring on incognito mode or trying different browsers.

    I should add also that the XG would catch this using the Category InvalidURL. (not in my Web Policy)

    As you mentioned only the first time accessing would be allowed, however clicking anything on the site, would then show the blocked Website.

    I will be updating this post once I hear back from GES.

    And thank you Prism for the video. 

    Regards,

     
    Emmanuel (EmmoSophos)
    Technical Team Lead, Global Community Support
    Sophos Support Videos | Product Documentation  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'Verify Answer' link.
Children
  • 0 in reply to emmosophos

    Okay, thanks for helping out.

    Just a few more points:

    • My first thought was to just block the InvalidURL web category, but it turns out that there is no category named that which can be added to a User Activity.
    • Is it technically an invalid URL with the dot at the end? Your previous posts with the links indicate that it's actually a Fully-Qualified Domain Name.
    • This issue could be exploited by malware, as a way to bypass the web filter and communicate with a host on the Internet using HTTP.

    I look forward to your update.

  • 0 in reply to haydenspence

    It is technically a valid domain name - eg it matches the internet specification.  However they are almost never used.  Most web servers will redirect you to what they consider the "normal" FQDN is.  Several web browsers will automatically change the domain name to the one without the period.  Therefore in normal browsing the chance that this happens/matters is very low.  Yes a malware author could use this to bypass some checks, however it is not a common technique.


    The system that looks up categories based on the domain name incorrectly considers them to be invalid.

    The URL Group is used in several different areas.  Some areas may not do the matching correctly.

  • 0 in reply to Michael Dunn

    Hi, Michael. I've just looked over the release notes for v18 MR5, and there is no mention of this issue as either resolved or known. What is the status of this with the development teams?

  • 0 in reply to haydenspence

    Hello,

    This is being raised to GES as two different issues:

    1) Sites are coming back with incorrect category (Invalid).
    2) Sites are not matching URL groups when there is a trailing period
    Regards,
     
    Emmanuel (EmmoSophos)
    Technical Team Lead, Global Community Support
    Sophos Support Videos | Product Documentation  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'Verify Answer' link.
Unfiltered HTML