# Bitrix WAF bypass

Bitrix WAF strips null bytes from request params before comparing to page body, so %00 in a reflected XSS param bypasses the filter and executes script.

- Payout: unconfirmed
- Severity: medium
- Program: Mail.ru
- Credited: Roma Ramazanoff
- Disclosed: 2020-04-27
- CVE: CVE-2020-13758
- Write-up quality: 7/10
- Original: https://blog.deteact.com/bitrix-waf-bypass/
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-deteact-com-bitrix-waf-bypass
- Tags: domain:web impact:integrity kind:bounty platform:blog sev:medium tech:php technique:fuzzing technique:parser-differential vuln:misconfiguration vuln:xss

**Target:** Bitrix CMS security module post-filter (reflected param in script body)
**Root cause:** addVariable() strips chr(0) from parameter values via str_replace before isDangerBody() compares them against the raw page body; the body still contains \x00, so no match is found and the payload passes.
**Steps:**
1. Identify a GET param (e.g. `page`) reflected inside a `<script>` body on a Bitrix site with the security WAF module enabled.
2. Confirm baseline: `?page=")});alert(1);...` gets replaced with `<!-- deleted by Bitrix WAF -->`.
3. Insert a null byte before the closing quote: `?page=BYPASS%00")});alert(1);$(document).ready(function (){//`.
4. WAF comparison fails to match (param lacks \x00, body has it), payload renders and alert fires.
**How found:** Fuzzing Mail.ru under bug bounty, found a param reflected into a <script> body; WAF blocked payloads, so probed filter behavior and discovered a null byte in the param defeats the body-vs-param comparison.
**Exploitation:** Reflected XSS: attacker crafts a URL with %00 plus a script-breaking payload in a param reflected into a script body; victim clicking the link executes attacker JS in the Mail.ru origin.
**Insight:** When a WAF compares reflected input against the response body, look for normalization mismatches (null bytes, encoding, case) between the stored param and the rendered body — a single differing byte defeats the match.