For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

GlaseRing's avatar
GlaseRing
Icon for Nimbostratus rankNimbostratus
Aug 25, 2021

ASM don't block XSS

hi all, why the asm don't block this : "</script><script>window.top._arachni_js_namespace_taint_tracer.log_execution_flow_sink()</script>"><script>alert(150)</script>&arguments=-N2019,-A,-N325,-N0" ...
ASM Advanced WAF
security
xss
Erik_Novak's avatar
Erik_Novak
Icon for Employee rankEmployee
Aug 25, 2021

That string should trigger an attack signature violation. On my system, the attack signature ID is 200001475. Do you see that signature in your event log and is it possible that the signature is in staging?