Essential Insights
- Attackers can exploit the new "QUERY" method to bypass existing web application firewalls (WAFs) and security controls that only recognize traditional HTTP verbs, enabling malicious payloads to evade detection.
- Cache poisoning risks increase because "QUERY" requests are cacheable and often unrecognized by proxy and CDN caches, potentially delivering malicious responses to multiple users.
- Since "QUERY" requests carry bodies and are unhandled by many existing security measures, they can be used for illicit data exfiltration or command execution without triggering standard defenses.
Threats, Attack Techniques, and Targets
The new HTTP method "QUERY" was published in June 2026. It is a safe and idempotent method that sends a request with a body, unlike traditional GET requests. Since it can carry data in the body, it behaves like a mix of GET and POST. Attackers could use QUERY to bypass security controls that only look for certain HTTP verbs like POST or GET. For example, malicious payloads can be sent using the QUERY method to avoid detection by web application firewalls (WAFs) and other security measures. The targets include web servers and APIs, especially those that do not recognize or handle "QUERY" properly. Attack techniques may involve injecting malicious code or data through a "QUERY" request to exploit existing vulnerabilities.
Impact, Security Implications, and Remediation Guidance
The use of "QUERY" can create security gaps. Since some systems do not recognize it, they might process or cache these requests unexpectedly. For example, cache servers that do not differentiate based on request bodies could serve malicious payloads to others. WAFs and CSRF protections that rely on specific HTTP verbs may not catch queries sent with "QUERY" and therefore may fail to block malicious activities. The impact includes potential cache poisoning and bypassed protections.
If you manage web infrastructure, it is crucial to update your security rules and controls to detect and handle "QUERY." Specifically, you should modify your rules to include "QUERY" as a valid method, like http.method in ("GET", "POST", "QUERY"). For proper handling, contact your security vendor or review official guidance to ensure your environment can recognize and block malicious use of this method. Given the novelty of "QUERY," consult the relevant vendor documentation for tailored remediations.
Expand Your Tech Knowledge
Stay informed on the revolutionary breakthroughs in Quantum Computing research.
Access comprehensive resources on technology by visiting Wikipedia.
ThreatIntel-V1
