Topic starter
02/08/2026 12:03 pm
TL;DR: Double-encoded path traversal and local file inclusion payloads slipped past a WAF in healthcare API traffic, Salt said, because the malicious input was normalised differently upstream and downstream. API controls need to inspect the final decoded form, or edge filtering can miss payloads that still reach backend logic.
Editorial analysis by NHI Mgmt Group, based on content published by Salt: “Why Your WAF Missed It: The Danger of Double-Encoding and Evasion Techniques in Healthcare Security”.
Key questions
Q: Why do double-encoded payloads increase API risk?
A: They exploit differences in how layers normalise requests.
Q: What signs indicate API traffic is being used for evasion?
A: Look for repeated encoding, odd payload symmetry, sudden changes in path or parameter structure, and requests that are technically valid but operationally unusual for the endpoint.
Q: What fails when a WAF only decodes API input once?
A: The failure is a canonicalisation gap.
Practitioner guidance
- Align canonicalisation across the request path Test how the WAF, gateway, middleware, and application each decode the same API request, then remove any mismatch that lets malicious input change form between layers.
- Add behavioural detections for anomalous payload structure Detect encoded traversal patterns, unusual repetition, and request shapes that deviate from normal client behaviour rather than relying on static malicious strings alone.
- Validate backend enforcement on decoded input Make sure the application validates the final canonical form before file access, routing, or downstream execution occurs.
Bottom line: Double-encoding can turn a familiar API exploit into a request that slips past edge inspection while still reaching dangerous backend logic.
Glossary terms: Double Encoding, Canonicalisation, Path Traversal, Local File Inclusion
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 1:09 pm
Double-encoding is a canonicalisation failure, not just an input-validation problem. The security issue is not that the payload exists, but that different components interpret the same request differently. That creates a control gap between detection and execution, which is exactly where API defence fails in practice. Practitioners should treat canonical form consistency as a governance requirement for API gateways, parsers, and backend services.
A few things that frame the scale:
- 60% of healthcare organisations do not assess a vendor's security before signing a contract that grants access to protected health information, according to Ponemon Institute's 2023 Third-Party Risk in Healthcare report.
A question worth separating out:
Q: How should teams respond when perimeter filtering misses malicious API input?
A: Treat it as a control-design issue, not a one-off bypass. Validate request decoding at each layer, add behavioural detections for suspicious payload structure, and enforce business-logic checks on the final canonical form before sensitive operations occur. That reduces the chance that upstream filtering and backend execution disagree.
👉 Read our full editorial: WAF evasion through double encoding exposes API security gaps