For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

0veracl0ud_1734's avatar
0veracl0ud_1734
Icon for Nimbostratus rankNimbostratus
Dec 04, 2015
Solved

ASM - Block GET requests on a specific URL

Hello,   I'm trying hard to block GET request on a specific URL with the ASM module. This URL has to allow only POST request and I saw that GET / POST request are allowed by default in the methods...
  • Hannes_Rapp_162's avatar
    Dec 07, 2015

    1 - Creating a new User-defined ASM violation

    Security > Options > Application Security > Advanced Configuration > Violations List > User Defined Violations (tab); Select "Create New User-Defined Violation"

    Sample Field Values (adjust as needed):
    Name "VIOLATION_FORBIDDEN_GET_PATH"
    Title "GET Request to a restricted path"
    Type "Access Violation"
    Severity "Alert"
    Attack Type "Abuse of Functionality"
    Description (leave empty)
    

    2 - Go to Blocking Settings

    Select Block for your new custom violation (or Alarm, if you want to transparently test)

    3 - Creating an iRule

    The sample below covers the most simple use-case, a single path. In case of 10 or more paths, using a LTM data group entry match, or a switch statement would be a better option.

    when HTTP_REQUEST {
      set reqBlock 0
      if {([HTTP::method] equals "GET") and ([string tolower [HTTP::path]] equals "/mypath/index.aspx")}{
        set reqBlock 1
      }
    }
    when ASM_REQUEST_DONE {
    
      if { $reqBlock == 1} {
        ASM::raise VIOLATION_FORBIDDEN_GET_PATH
      }
    }