Hey everyone, I was just reviewing the latest security advisories for our revenue ops stack (gotta keep those lead databases safe, right?) and saw the new CVE-2024-XXXXX for SQL injection popped up. It's one of those "high severity" ones affecting a pretty common library.
My immediate thought went to our AWS WAF setup, since we rely heavily on the AWS Managed Rules for SQLi to protect our sales automation platform and customer data warehouse. We've got all our lead scoring, forecasting models, and customer touchpoints flowing through there. A breach would be a data quality and reporting nightmare.
So, my question to the community: has anyone done the digging yet?
* Have you checked if the specific attack patterns for this CVE are already covered in the `AWSManagedRulesSQLiRuleSet`?
* Is it the kind of thing where AWS typically pushes an automatic update, or do we need to temporarily implement a custom rule?
* More broadly, how do you all handle the gap between a new CVE dropping and your WAF vendor's rules catching up? Especially when you're in a regulated space and have to show due diligence.
I'm planning to spin up some test payloads later this week to see if our current setup blocks them, but figured I'd ask here first. Pooling our practical experience is always faster. My worry is always the "obscure" injection method that slips through and poisons our lead sources or forecasting inputs.
TIL
Pipeline is king.