Overview

Use ASM Exploit Prevention to protect your critical applications and APIs against zero-day vulnerabilities without tuning or reconfiguration.

With ASM’s context-aware capabilities, you can gain a deep understanding of application logic, data flow, and state.

Combine telemetry from the Datadog tracer with predefined heuristics to detect and block exploits with higher accuracy, ensuring legitimate traffic remains unaffected.

You can use ASM Exploit Prevention in the following use cases:

Example 1: Server-side request forgery

An attacker tricks the server into making unauthorized requests to internal systems or external servers, potentially leaking information or a further exploitation.

ASM Exploit Prevention checks whether an internal or external request’s URL, which is partially or totally controlled by a user parameter, has been manipulated by an attacker to alter the original purpose of the request.

Example 2: Local file inclusion

An attacker exploits a vulnerable parameter to include local files from the server, potentially exposing sensitive data like configuration files or possibly enabling remote code execution.

ASM Exploit Prevention inspects all file access attempts to determine if the path has been injected and whether a restricted file is accessed.

Example 3: SQL injection

An attacker injects malicious SQL code into a query, potentially gaining unauthorized access to the database, manipulating data, or executing administrative operations.

ASM Exploit Prevention intercepts all SQL queries to determine if a user parameter has been injected and whether the injection alters the original purpose and structure of the SQL query.

Prerequisites

• Ensure that your applications are instrumented with the Datadog tracer.
• ASM Threat Management must be enabled. See Threat Management Setup.
• Ensure Remote Configuration is enabled to push rule updates and In-App WAF policies. See Enabling Remote Configuration.

Library Compatibility

Note: Estimated availability of Exploit Prevention support for Ruby is Q4 ‘24.

Enabling Exploit Prevention

1. Navigate to In-App WAF (Security > Application Security > Protection > In-App WAF).

2. If you have applied a Datadog managed policy to your services, then follow these steps:
   a. Clone the policy. For example, you can use the Managed - Block attack tools policy.

   b. Add a policy name and description.
   c. Click on the policy you created and select the Local File Inclusion ruleset. Enable blocking for the Local File Inclusion exploit rule.
   d. Similarly, select the Server-side Request Forgery ruleset and enable blocking for the Server-side request forgery exploit rule.

3. If you have applied a custom policy for your services, you can skip Steps 2.a and 2.b for cloning a policy and directly set the Exploit Prevention rules in blocking mode (Steps 2.c and 2.d).

Reviewing exploit attempts in ASM

After you have enabled Exploit Prevention, if ASM detects an exploit attempt, it proceeds to block that request. Exploit Prevention detections are always accompanied by stack traces, which provide full visibility of where the vulnerability lies in your code, ensuring a clear path to remediation.

In addition, ASM also generates a signal correlating all the blocked traces and isolating the attacker IP addresses that are targeting your service(s). You can take action by blocking all attacking IPs.

Further Reading

Additional helpful documentation, links, and articles:

Protect against threats with Datadog Application Security ManagementDOCUMENTATION Other setup considerations and configuration optionsDOCUMENTATION