---
title: Tip: if a WAF is the only thing hiding an admin console, test it with %2f, dot segments and ;-parameters, then remove the console | ctxsec
url: https://ctxsec.com/items/tip-test-waf-blocked-admin-paths-with-encoded-and-semicolon-variants
description: "Path-pattern blocking at the edge fails whenever the backend normalizes URLs differently. In the automaker case, /static%2f..;/system%2fconsole;/bundles/.json passed the edge and reached the Felix console behind it."
status: "operational guidance (from Curry and Shah's ForgeRock write-up, Nov 7)"
published: 2026-11-09
---

> Path-pattern blocking at the edge fails whenever the backend normalizes URLs differently. In the automaker case, /static%2f..;/system%2fconsole;/bundles/.json passed the edge and reached the Felix console behind it.

[← Tips & Guides](/tips) · [markdown](/items/tip-test-waf-blocked-admin-paths-with-encoded-and-semicolon-variants.md)

operational guidance (from Curry and Shah's ForgeRock write-up, Nov 7)

2026-11-09

### Tip: if a WAF is the only thing hiding an admin console, test it with %2f, dot segments and ;-parameters, then remove the console

- For each blocked admin route, request variants under an allowed prefix: `%2f` instead of `/`, `/..;/`, `;` path parameters and doubled encodings, and compare status codes. A 401 where you expected a 403 means the request got through to the app.
- Don't treat the WAF as authentication. Remove admin consoles you don't need in production, bind the rest to an internal interface, and change default credentials.
- Alert on `%2f..;` and `..;/` in access logs; legitimate clients rarely send them.

Sources: [Sam Curry and Shubham Shah: Hacking Two Automakers, ForgeRock Path Confusion, RCE, and Remote Vehicle Access (Nov 7)](https://samcurry.net/forgerock)