ACF Forms payload gets blocked via POST Base64 policy

Dear team,

first of all – thank you for the great plugin! Let’s me sleep better. ??

Nevertheless I am actually facing an issue with the base64 decoding of POST requests on my page. I like that feature and don’t want to disable it, in order to keep my sleep at a good level.

But leaving the feature enabled gets me into the following issue: I am using the very popular plugin Advanced Custom Fields PRO (ACF) and just began to leverage the forms feature on the “frontend” for website visitors, in order to collect complex data for a PhD thesis.

Currently every submission of a non-whitelisted user is going to be blocked by the firewall with the following log entry:

24/Mar/21 02:30:03  #3279953  CRITICAL     -  XXX.XXX.XXX.XXX    POST /index.php - BASE64-encoded injection - [POST:_acf_form = eyJkaXNwbGF5X3RpdGxlIjpmYWxzZSwiZGlzcGxheV9kZXNjcmlwdGlvbiI6ZmFsc2UsImlkIjoiZm9ybV82MDVhMzBkN2E5MDc3IiwidmFsdWVzIjpbXSwic3VibWl0X3RleHQiOiJTdWJtaXQiLCJyZWRpcmVjdCI6bnVsbCwidGFyZ2V0Ijo...]

I’ve analyzed what’s going on and found out, that ACF forms are using two hidden form fields in order to submit configuration data. This is how ACF forms work and without the configuration data it’s not going to work.

Now the whole payload that gets flagged by the base64 policy is this:

eyJkaXNwbGF5X3RpdGxlIjpmYWxzZSwiZGlzcGxheV9kZXNjcmlwdGlvbiI6ZmFsc2UsImlkIjoiZm9ybV82MDVhMzBkN2E5MDc3IiwidmFsdWVzIjpbXSwic3VibWl0X3RleHQiOiJTdWJtaXQiLCJyZWRpcmVjdCI6bnVsbCwidGFyZ2V0IjoiaHR0cHM6Ly93d3cuZml0bmVzc3dhcnJpb3IuZGUvdGVzdC8iLCJlY2hvIjp0cnVlLCJleGNsdWRlX2ZpZWxkcyI6W10sInVwbG9hZGVyIjoid3AiLCJmaWx0ZXJfbW9kZSI6ZmFsc2UsImxhYmVsX3BsYWNlbWVudCI6InRvcCIsImluc3RydWN0aW9uX3BsYWNlbWVudCI6ImxhYmVsIiwiaG9uZXlwb3QiOnRydWV9

which is deccoded like this:

{"display_title":false,"display_description":false,"id":"form_605a30d7a9077","values":[],"submit_text":"Submit","redirect":null,"target":"https:\/\/www.fitnesswarrior.de\/test\/","echo":true,"exclude_fields":[],"uploader":"wp","filter_mode":false,"label_placement":"top","instruction_placement":"label","honeypot":true}

If I take the same base64 string and submit it via a different way (e.g. via a input field of Contact Form 7) it is get blocked by the firewall policy as well, of course.

Now when I use a simple base64 string

TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQgeCBoaWJpcyBiZWJhbQ==

which decodes to

Lorem ipsum dolor sit amet x hibis bebam

the base 64 policy does not apply. Which leaves me with the hope that it is just a simple mis- or overinterpretion of the configuration string as malicious code and that we can fix this together. ??

Again, disabling the whole base64 function would not be a good option for me.

Let me hear your thoughts.

Best,
Norman