For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

sbobic_232506's avatar
sbobic_232506
Icon for Nimbostratus rankNimbostratus
Dec 15, 2015

Applying iRule to ASM policy - file upload form protection

So, I have found the following iRule which should block the upload of PHP files in file upload forms: when HTTP_REQUEST { if { [HTTP::header exists "Content-Disposition"] } { ...
ASM Advanced WAF
security
sbobic_232506's avatar
sbobic_232506
Icon for Nimbostratus rankNimbostratus
Dec 17, 2015

Disallowing file types will make the web app inaccessible as it's made in PHP. Plus, as a pentester, I would like to have full control in order to block all file upload vulnerabilities(.php3, .phps, exif data, .htaccess shells etc)

 

All of my logs(illegal, and all requests) at Security > Event Logs > Application > Requests are empty. Maybe because I have set automatic learning mode, and I've started building the policy just yesterday.