Exploit Prevention

Overview

Use App and API Protection’s Exploit Prevention to protect your critical applications and APIs against zero-day vulnerabilities without tuning or reconfiguration.

With App and API Protection’s context-aware capabilities, you can gain a deep understanding of application logic, data flow, and state.

Combine telemetry from the Datadog SDK with predefined heuristics to detect and block exploits with higher accuracy, ensuring legitimate traffic remains unaffected.

This is powered by Runtime Application Self Protection (RASP), which allows you to detect and prevent attacks in real time.

For details on how Exploit Prevention differs from In-App WAF, see Exploit Prevention vs. In-App WAF.

How exploit prevention works

1. With the Datadog App and API Protection SDK instrumented in your applications, details are captured about every interaction within the application, including requests, code execution, and data flows.
2. When an attack payload reaches the application, App and API Protection evaluates if the payload triggers code paths tied to known vulnerabilities.
3. If a potential exploit is detected:
   1. App and API Protection blocks the request in real-time before it causes damage.
   2. App and API Protection raises security signals for further investigation.
4. Exploit prevention detections are accompanied by stack traces that provide full visibility of the code location of the vulnerability, providing a clear path to remediation.

Example 1: Server-side request forgery

An attacker tricks the server into making unauthorized requests to internal systems or external servers, potentially leaking information or enabling further exploitation.

App and API Protection Exploit Prevention checks whether an internal or external request’s URL, which is partially or totally controlled by a user parameter, has been manipulated by an attacker to alter the original purpose of the request.

Example 2: Local file inclusion

An attacker exploits a vulnerable parameter to include local files from the server, potentially exposing sensitive data like configuration files or possibly enabling remote code execution.

App and API Protection Exploit Prevention inspects all file access attempts to determine if the path has been injected and whether a restricted file is accessed.

Example 3: SQL injection

An attacker injects malicious SQL code into a query, potentially gaining unauthorized access to the database, manipulating data, or executing administrative operations.

App and API Protection Exploit Prevention intercepts all SQL queries to determine if a user parameter has been injected and whether the injection alters the original purpose and structure of the SQL query.

Prerequisites

• Ensure that your applications are instrumented with the Datadog SDK.
• App and API Protection must be enabled. See Setup.
• Ensure Remote Configuration is enabled to push rule updates and In-App WAF policies. See Enabling Remote Configuration.

Library Compatibility

Enabling Exploit Prevention

1. Navigate to In-App WAF.
2. If you have applied a Datadog managed policy to your services, then follow these steps:
   1. Clone the policy. For example, you can use the Managed - Block attack tools policy.
   2. Add a policy name and description.
   3. Click on the policy you created and select the Local File Inclusion ruleset. Enable blocking for the Local File Inclusion exploit rule.
   4. Similarly, select the Server-side Request Forgery ruleset and enable blocking for the Server-side request forgery exploit rule.
3. If you have applied a custom policy for your services, you can skip Steps 2.a and 2.b for cloning a policy and directly set the Exploit Prevention rules in blocking mode (Steps 2.c and 2.d).

Reviewing exploit attempts in App and API Protection

After you have enabled Exploit Prevention, if App and API Protection detects an exploit attempt, it proceeds to block that request. Exploit Prevention detections are always accompanied by stack traces, which provide full visibility of where the vulnerability lies in your code, ensuring a clear path to remediation.

In addition, App and API Protection also generates a signal correlating all the blocked traces and isolating the attacker IP addresses that are targeting your service(s). You can take action by blocking all attacking IPs.

Further Reading

Request a personalized demo