WAF evasion through double encoding exposes API security gaps

At a glance

What this is: This is an API security analysis showing how double-encoded payloads can bypass signature-based WAF inspection and why behaviour-aware detection matters.

Why it matters: It matters to IAM practitioners because public APIs often sit behind identity, authorisation, and service-account controls that still fail if request validation and abuse detection only inspect syntax.

By the numbers:

• Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, followed by inadequate monitoring and logging (37%) and over-privileged accounts (37%).
• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.

👉 Read Salt's analysis of double-encoded API attacks and WAF evasion

Context

API security fails when teams trust a green dashboard more than the underlying request path. In this case, the problem is not simply whether a WAF is deployed, but whether it can recognise malicious intent after an attacker transforms the payload to evade normal signature matching. For identity-adjacent programmes, the lesson is that service exposure, authentication, and request validation all need to be assessed together.

Double encoding is a classic evasion method because one layer of decoding can make an exploit look harmless while a later application layer restores the attack string. That matters for IAM and NHI programmes because APIs are often invoked by service accounts, tokens, and automation pipelines, which means abuse can look like legitimate machine traffic unless telemetry and policy are designed to inspect behaviour, not just syntax.

Key questions

Q: What breaks when a WAF only inspects API payloads once?

A: A single inspection pass can miss malicious input that changes meaning after additional decoding in the backend. That creates a gap between what the edge sees and what the application executes, which is why traversal and local file inclusion attacks can bypass controls that look healthy on a dashboard.

Q: Why do encoded API attacks remain effective against mature controls?

A: They remain effective because many controls are tuned to known strings, not to the decoding chain that reconstructs the exploit. If the attacker can make harmless-looking text become dangerous only after backend parsing, the control is checking the wrong layer and the wrong condition.

Q: How do security teams know if API abuse controls are working?

A: Security teams know API abuse controls are working when repeated credential use drops, abnormal request volume is detected early, and hostile client behaviour is blocked before backend systems see sustained load. Effective controls reduce both attack success rate and the time abuse can persist unnoticed.

Q: Should organisations rely on WAF rules alone for public APIs?

A: No. WAF rules are useful, but they should be one layer in a broader control set that includes behavioural analytics, request normalisation testing, and application-side validation. For APIs used by service accounts or automation, this layered approach is essential.

Technical breakdown

How double encoding defeats WAF signature checks

A signature-based WAF inspects requests for known malicious patterns such as ../, which often indicate path traversal. Attackers can double-encode the same characters so the first decoding pass turns the payload into a string that appears safe, while the backend application decodes it again and restores the exploit. This is not a failure of the encoding standard. It is a failure of inspection depth, normalisation consistency, and context-aware validation across the request path.

Practical implication: validate how many decoding passes your edge controls and application stack actually apply, then test for bypasses at each layer.

Why context-aware API detection catches what signatures miss

Behaviour-based systems look at request patterns, payload structure, and deviations from expected API usage rather than only matching a malicious string. That matters because legitimate traffic usually follows stable shapes, while evasion attempts often introduce unusual encoding depth, parameter nesting, or traversal indicators that stand out statistically. In practice, this gives defenders a better chance of identifying attack campaigns that mutate their syntax but preserve their intent.

Practical implication: add anomaly detection and request-shape analytics to API monitoring, not just static WAF rules.

Agentic AI and automated logic fuzzing against APIs

The article’s forward-looking point is that AI agents can automate evasion research at machine speed. An agent can iterate through encoding variants, Unicode tricks, and request splitting until it finds a payload that passes controls built for human-scale testing. That turns API abuse into a search problem for the attacker and a coverage problem for defenders, especially where machine identities and tokens are used to access public endpoints.

Practical implication: assume automated adversaries will probe your API controls continuously and design for detection of trial-and-error abuse.

Threat narrative

Attacker objective: The attacker wants to bypass perimeter inspection and reach sensitive backend files or data through the API.

1. Entry occurs through a public-facing API endpoint where the attacker sends a double-encoded traversal payload that appears benign after one decoding step.
2. Escalation happens when the backend decodes the payload again and turns the request into path traversal or local file inclusion behaviour.
3. Impact is access to sensitive files or application data that should have been unreachable through the catalog API.

NHI Mgmt Group analysis

Green dashboards create a false governance signal: a passing WAF does not mean an API is safe if inspection stops at the first decoding layer. The control failure is not just technical, it is procedural, because teams often treat signature coverage as equivalent to security assurance. In practice, API governance must evaluate normalisation, backend parsing, and abuse detection together.

Intent-based detection is now a policy requirement, not a luxury: signature rules can block yesterday’s payloads but not the attacker’s next encoding variant. Behavioural analysis matters because evasion is a moving target, especially where machine identities generate high-volume traffic that can hide abuse inside legitimate automation. The practitioner conclusion is that API security policy must include behavioural thresholds and exception handling.

Machine identity expands the blind spot: when APIs are accessed by service accounts, tokens, or automation pipelines, malicious requests can resemble ordinary workload traffic. That creates a governance gap between authentication and authorisation on one side and request-level abuse detection on the other. Payload normalisation gap: the specific failure mode here is inconsistent decoding between the edge and the backend, which lets one layer see harmless input and another see an exploit. Teams should treat this as a control-design issue, not a tuning issue.

Agentic AI will industrialise evasion testing: the article’s warning is credible because AI agents can rapidly enumerate payload permutations and test which one survives. That shifts API defence toward continuous control validation, not periodic rule review. For the field, this is a signal that syntax-only inspection is becoming a legacy assumption rather than a durable security model.

What this signals

Payload normalisation is becoming an identity-adjacent control problem: the more API traffic is generated by service accounts, tokens, and automation, the harder it becomes to separate malicious requests from legitimate machine activity. That means API security programmes need better inspection of request shape, not just perimeter filtering, and they should align detection logic with identity telemetry where workload access is in play.

Agentic abuse will reward teams that can test controls continuously: attackers will increasingly automate encoding and parsing variants until one survives. That shifts the operating model toward continuous validation of edge, gateway, and application controls. For practitioners, the priority is to prove that detections fire on mutated input before those requests reach business logic.

For practitioners

• Test normalisation consistency across the full request path Recreate the same payload at the edge, gateway, and application layer to confirm each component decodes input the same way. If one layer normalises once and another normalises recursively, document the gap and tune controls around the backend parsing behaviour.
• Add behavioural detection for API abuse patterns Track unusual encoding depth, repeated parameter mutation, and traversal-like request shapes alongside standard WAF alerts. Feed those signals into your API telemetry so anomaly detection can flag intent even when signatures fail.
• Create a traversal-specific regression test suite Maintain malicious test cases for double encoding, triple encoding, and Unicode obfuscation in pre-production validation. Run them whenever you change gateway, WAF, or application parsing logic so bypasses do not reappear after configuration changes.

Key takeaways

• WAF coverage alone is not a reliable assurance model when attackers can change a payload’s meaning after multiple decoding steps.
• Behaviour-based detection and request-path validation are the controls that expose encoding evasion before the backend executes it.
• API security programmes should test for machine-driven mutation, because AI-assisted probing will make syntax-only controls easier to evade.

Key terms

• Double Encoding: Double encoding is a technique where an attacker encodes the same characters more than once so different layers interpret the payload differently. In API attacks, the edge may see benign text after one decode pass while the backend restores the malicious string and executes the exploit.
• Path Traversal: A bug where crafted path segments such as ../ allow input to escape an intended directory boundary. In practice, it turns a normal file operation into a boundary break, which is especially dangerous when the affected service runs with non-human identity privileges and touches production data or secrets.
• Local File Inclusion: Local file inclusion is a vulnerability where an application accepts a path or file reference that lets an attacker access unintended local files. It usually results from weak input validation and can expose configuration, code, or other sensitive server-side content.
• Behavioral Detection: A monitoring approach that looks for unusual activity rather than relying only on static inventories. For SaaS integrations, it detects drift in token use, data movement, timing, and endpoint behavior so teams can spot compromise, misuse, or automation that no longer matches its expected pattern.

What's in the full article

Salt's full article covers the operational detail this post intentionally leaves for the source:

• The exact double-encoded payload pattern used to bypass the WAF and the decoding sequence that made it effective
• The custom regex rule the customer applied to catch the traversal pattern at the WAF layer
• How the alert data was integrated into Cloudflare, Splunk, and Wiz workflows for detection and prevention
• How the posture governance engine was used to identify and remediate API security gaps as the attack surface expanded

👉 Salt's full article covers the attack pattern, detection method, and remediation example in more operational detail.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security practitioners connect identity controls to the wider governance and risk decisions their programmes depend on.