Mar 27, 2026 - For details about updated CVE-2025-53521 (BIG-IP APM vulnerability), refer to K000156741.

Forum Discussion

Ted-Nordvall's avatar
Ted-Nordvall
Icon for Altocumulus rankAltocumulus
May 21, 2026

APM URL encoding Hardening?

Some companies still use on-prem Sharepoint.. and Sharepoint is what it is.
We have had multiple servers deployed for quite some while now with ASM tuned for its quirks and so on.

However - after upgrading to version 17.5.1.6 from 17.5.1.5 we noticed some rather strange behaviors.

Like the edit modal button stopped working on certain sites, the upload button stopped working amongst some of the stuff. After some testing and stripping of functions we noticed that it started working when removing the APM policy. So the cogs started turning, what could be the issue with APM? 
Finally figured out that the links which did not work where not encoded, and the links which worked were. 

So after some tweaking I got to building a simple http request rewrite iRule for simply encoding the stuff before sending to server.

But I do have some qualms about it - Are there any security risks according to you dear people that I might introduce by deploying this externally? Would you have solved it in any other way?

basically it's this:

when HTTP_REQUEST {
# Re-encode characters that are illegal in URIs per RFC 3986 §2.2 / §3.4

    set orig_uri [HTTP::uri]
    set new_uri [string map {
        "\{" "%7B"
        "\}" "%7D"
        "|"  "%7C"
        "\\" "%5C"
        "^"  "%5E"
        "`"  "%60"
        " "  "%20"
    } $orig_uri]

 

    if { $new_uri ne $orig_uri } {
        HTTP::uri $new_uri

   }

}

No RepliesBe the first to reply