What is the DMZ-backend short circuit anti-pattern (German DMZ-Backend-Kurzschluss)?
Connecting the DMZ to the backend without further controls, for example by synchronising the DMZ database directly with the internal database. This creates an uncontrolled passage between the DMZ and the perimeter of the backend systems, so whatever compromises the DMZ can flow straight into the internal systems.
* The WAF and the zone firewalls are intact, but a direct database sync carries the attack around all of them. *
The attack path in the example: an attacker manipulates what a web browser sends; the request passes the WAF (which can't catch everything), compromises the web server, and from there the DMZ database. A database-level sync then copies the manipulated data, or the attacker's access, directly into the merchandise-management database (WWS-DB) inside the company. The internal zones have firewalls of their own, but the sync is a permitted, trusted channel that nobody inspects.
The database sync is only one example: uncontrolled crossings are possible on every protocol level (file shares, message queues, shared credentials, a management network, an API call without checks). The cure is the controlled data-transfer path from the previous card.
Go deeper:
MITRE ATT&CK TA0008 — Lateral Movement — how attackers move from a first foothold to further systems.- Replication (computing) — Wikipedia — what a database sync does, and why it carries whatever is in the source.