F5 is upgrading its customer support chat feature on My.F5.com. Chat support will be unavailable from 6am-10am PST on 1/20/26. Refer to K000159584 for details.

Forum Discussion

mgjk_229461's avatar
mgjk_229461
Icon for Nimbostratus rankNimbostratus
Jan 25, 2016

ASM - Truncated and Blocked, why?

I'm trying to figure out why this particular request keeps getting blocked.   Normally when I see a block, above the request details, it gives some clue as to why exactly it was blocked. This one...
ASM Advanced WAF
BIG-IP
security
samstep's avatar
samstep
Icon for Cirrocumulus rankCirrocumulus
Jan 26, 2016

F5 reporting module truncates requests over 5Kb (used to be 10Kb before v11.4.0) when logging the requests. This is done to save space in the F5 ASM's internal reporting database/disk. Otherwise an attacker could easily fill up the disk on the F5s by repeatedly sending large illegal requests. The actual request reaches the backend server in normal state (unless you are in BLOCKING mode, in which case the request never reaches the back-end and the attacker gets the blocking response page).

 

Check out F5 Solution sol12044: The BIG-IP ASM Reporting screen now truncates request details for requests more than 5 KB in size

 

The violation you have appears to be the Multiple Decoding evasion where attackers double or triple-encode (or escape) the URI parameters to avoid detection. ASM allows you to increase the decoding passes when tuning the policy Under Blocking/Settings/RFC Violations/Evasion Technique Detected. I suggest you increase it to 3.

 

I guess the actual question for you is to analyze whether you want these kind of requests blocked or whether it is a false positive due to spaces/extra escaping in URI and you need to modify your policy.

 

Hope this helps,

 

Sam