Question

A company hosts a public web application behind an Application Load Balancer, fronted by CloudFront. A zero-day exploit targeting a widely-used Java logging library is being actively exploited in the wild, and a patched version of the application will not be available from the vendor for several days. The security team needs an immediate mitigation that blocks known exploitation patterns for this vulnerability at the edge, without waiting for the application patch. Which action provides the fastest effective protection?

Accepted Answer

Add the AWS Managed Rules Known Bad Inputs rule group to the WAF web ACL, which includes signatures for this exploit, and associate the web ACL with the CloudFront distribution.

Answer

Enable AWS Shield Advanced on the CloudFront distribution to have the Shield Response Team block the exploit traffic.

Answer

Create a Network Firewall rule group with a Suricata signature for the exploit and deploy it in the VPC hosting the ALB.

Answer

Configure a WAF rate-based rule set to a low threshold to throttle any client attempting the exploit request.