Mitigation · Compensating Controls

Mitigation Guides

Layered mitigation playbooks for critical vulnerability classes. Use when patches cannot be immediately deployed. Controls span network, WAF, host, application and monitoring layers.

Full Prevention — Prevents exploitation entirely

Partial — Significantly reduces exploitability or impact

Detection Only — Improves visibility, does not prevent exploitation

Remote Code Execution (RCE)

CVSS 9.0–10.0

Network Layer

·Egress filtering — block outbound on ports not required by the service
·Firewall rule: restrict inbound on non-standard ports to known source IPs
·IDS/IPS signature for exploit payload patterns (ShellCode, reverse shell)

WAF Layer

·Enable anomaly scoring rules (ModSecurity CRS paranoia level 2)
·Block requests with shell metacharacters in all parameters
·Enable server-side code injection detection rules (932xxx — RCE)

Host Layer

·Disable script execution in web server document root (noexec mount)
·Apply principle of least privilege to service account (no root/SYSTEM)
·Enable seccomp/AppArmor profile to restrict syscalls

Detection Layer

·Alert on unexpected outbound connections from web servers
·Monitor for child processes of web server (bash, cmd.exe, powershell)
·Log process creation with full command line arguments (Sysmon/auditd)

Rule Example

# ModSecurity CRS — shell injection detection
SecRule REQUEST_COOKIES|ARGS "@rx (?:;|\||&&|\$\(|\`|\{|\})" \
    "id:9300001,phase:2,block,log,msg:'Shell Injection Attempt'"

SQL Injection

CVSS 7.5–9.8

Application Layer

·Deploy parameterised queries / ORM (cannot be fixed via WAF alone)
·Disable verbose SQL error messages in production
·Remove or restrict database accounts from DROP/ALTER permissions

WAF Layer

·Enable OWASP CRS SQLi ruleset (942xxx rules)
·Block UNION SELECT, information_schema, xp_cmdshell patterns
·Enable SQL data leakage rules (951xxx) to catch error-based SQLi

Database Layer

·Apply least-privilege DB accounts per application function (read vs write)
·Enable database activity monitoring (DAM) for unusual query patterns
·Audit all DDL statements

Detection Layer

·Alert on large response sizes to API endpoints (potential data exfil)
·Monitor for UNION / ORDER BY / SLEEP / BENCHMARK in logs
·Baseline query patterns and alert on deviation

Rule Example

# ModSecurity — SQL injection detection
SecRule ARGS "@detectSQLi" \
    "id:9300002,phase:2,block,log,msg:'SQL Injection Detected',logdata:'%{MATCHED_VAR_NAME}=%{MATCHED_VAR}'"

Server-Side Request Forgery (SSRF)

CVSS 7.5–9.8

Network Layer

·Block HTTP/S from application servers to cloud metadata (169.254.169.254)
·Implement egress proxy with allowlist for required external endpoints
·Disable unused URI schemes (file://, gopher://, dict://) at proxy layer

Application Layer

·Validate and allowlist URI schemes (https:// only)
·Resolve destination IPs and validate against RFC1918 blocklist before requests
·Disable HTTP redirects or validate redirect destination against allowlist

Cloud Layer

·AWS: enforce IMDSv2 with hop-limit=1 (blocks one-hop SSRF)
·Azure: restrict IMDS to require managed identity token
·Enable VPC endpoint policies to restrict S3 access to specific principals

Detection Layer

·Alert on HTTP requests from application tier to 169.254.x.x
·Monitor for cloud credential use from unusual source IPs
·Log all outbound HTTP connections from application servers

Rule Example

# Cloudflare WAF — block metadata endpoint access
(http.request.uri.path contains "169.254.169.254" or
 http.request.body.raw contains "169.254.169.254" or
 http.request.body.raw contains "metadata.google.internal") => block

Unsafe Deserialization

CVSS 8.1–9.8

Application Layer

·Replace Java Serializable with JSON (Jackson/Gson) or Protocol Buffers
·Implement deserialization filters (JEP 290 ObjectInputFilter in Java 9+)
·Blocklist known gadget chain classes (CommonsBeanutils, Spring, Groovy)

Network Layer

·Block Java serialization magic bytes (0xACED) at WAF/IDS if not needed
·Restrict endpoints accepting serialized objects to internal networks
·Rate limit endpoints that accept binary/serialized input

Runtime Layer

·Enable Java SecurityManager with restrictive policy (deprecated Java 17+, use agents)
·Use serialisation libraries with type-safe parsing only
·Apply RASP (Runtime Application Self-Protection) to flag unsafe deserialization

Detection Layer

·Alert on 0xaced 0x0005 magic bytes in inbound HTTP request bodies
·Monitor for unusual class loading patterns in Java application logs
·Log deserialization exceptions as potential probe attempts

Rule Example

# AWS WAF — block Java serialization magic bytes (0xAC 0xED, base64-encoded)
{
  "Name": "BlockJavaSerialization",
  "Statement": {
    "ByteMatchStatement": {
      "SearchString": "rO0=",
      "FieldToMatch": { "Body": {} },
      "PositionalConstraint": "CONTAINS"
    }
  },
  "Action": { "Block": {} }
}

Authentication Bypass / Broken Auth

CVSS 7.5–9.8

Network Layer

·MFA enforcement at VPN/Zero Trust gateway layer (blocks network-level access)
·Rate limiting: max 5 failed auth attempts per IP per minute with exponential backoff
·GeoIP restriction for authentication endpoints if user base is regional

Application Layer

·Force password reset for all accounts if auth layer is compromised
·Invalidate all active sessions and rotate session secrets immediately
·Audit and rotate service account credentials and API keys

Monitoring Layer

·Alert on mass authentication failures (>10 per minute per source IP)
·Alert on successful logins from new countries, ASNs or user agents
·Correlate authentication events with downstream activity patterns

Compensating Layer

·IP allowlisting for critical admin interfaces where feasible
·Privileged Access Workstation (PAW) requirement for administrative functions
·Just-in-time access provisioning via PAM solution (CyberArk, Delinea)

Rule Example

# Nginx rate limiting — authentication endpoint protection
limit_req_zone $binary_remote_addr zone=auth:10m rate=5r/m;
location /api/auth/login {
    limit_req zone=auth burst=10 nodelay;
    limit_req_status 429;
    add_header Retry-After 60 always;
}

XXE (XML External Entity)

CVSS 7.5–9.1

Application Layer

·Disable DOCTYPE declarations in XML parser configuration (parser-specific API)
·Disable external entity resolution — this is the root cause fix
·Disable DTD processing entirely if not required by application

WAF Layer

·Block DOCTYPE declarations in XML request bodies (OWASP CRS 921110+)
·Block SYSTEM and PUBLIC entity keywords in XML bodies
·Validate Content-Type header — reject non-XML to XML-only endpoints

Network Layer

·Outbound firewall rule: block HTTP/S from application to internal RFC1918 space
·Block file:// and gopher:// schema access from application processes
·DNS RPZ to block internal hostname resolution from DMZ applications

Detection Layer

·Alert on DOCTYPE or ENTITY keywords in inbound request bodies
·Monitor for outbound DNS queries to internal hostnames from DMZ servers
·Log XML parser exceptions and errors — often indicates probe attempts

Rule Example

# ModSecurity — XXE pattern detection
SecRule REQUEST_BODY "@rx <!(?:DOCTYPE|ENTITY)[^>]*(?:SYSTEM|PUBLIC)[^>]*>" \
    "id:9300003,phase:2,block,log,msg:'XXE Attempt Detected'"

Mitigation Decision Framework

Is a vendor patch available?

Apply immediately. CISA KEV: critical within 7 days, high within 30 days. Track with Patch Guidance page.

Can the system be isolated?

Network isolation/micro-segmentation reduces attack surface without modifying the vulnerable component.

Is compensating control sufficient?

Document for compliance (PCI DSS Req. 6.3.3, ISO 27001 A.8.8). Define scheduled patch date and residual risk acceptance.

Related Vulnerability Research

CVE DatabaseLive · NVD

Search 250,000+ CVEs from the NIST National Vulnerability Database. Live CVSS scores, CWE mappings and vendor references.

CVSS CalculatorInteractive

CVSS 3.1 base score calculator. Compute scores from attack vector, complexity, privileges, scope and impact metrics.

Vendor AdvisoriesLive · CISA KEV

Security advisory schedules and patch cadence for Cisco, Fortinet, Microsoft, Palo Alto, Juniper and 20+ vendors.

Exploit AnalysisReference

Exploit methodology reference: vulnerability classes, weaponisation lifecycle, PoC-to-exploit pipeline and detection opportunities.

Patch GuidanceLive · CISA KEV

Patch prioritisation framework: CVSS score, CISA KEV status, exploit availability and environmental context scoring.

Frequently Asked Questions

What is a compensating control?

An alternative security measure that reduces risk when the primary fix, usually a patch, can't be applied immediately — for example, a WAF rule blocking the exploit pattern while a patch is scheduled.

Can a WAF rule fully replace patching?

No — WAF rules and similar mitigations reduce exposure to known exploit patterns but don't fix the underlying flaw, and can be bypassed; they buy time until the vendor patch is applied.

How should compensating controls be documented for compliance?

Frameworks like PCI DSS (Req. 6.3.3) and ISO 27001 (A.8.8) expect a documented rationale, the compensating control applied, and a target date for the permanent fix.

What's the priority order when a patch isn't immediately available?

Assess exploitability and exposure, apply network isolation or segmentation if possible, deploy a compensating control such as a WAF rule or ACL for the specific exploit pattern, and set a firm remediation deadline.