hello is there an irule to DISABLE ASM attack signature on the Authorization header if value contains "Bearer" but still check attack signature on rest of the payload

Hi f5learner, Can you try this iRule? when ASM_REQUEST_DONE { if { [ASM::violation names] contains "VIOLATION_ATTACK_SIGNATURE_DETECTED" && [HTTP::header Authorization] starts_with "Bearer" } { ASM::unblock } } Trigger ASM iRule Events Mode should be set Normal on the WAF policy. Note that if the request has any violations other than "attack signature detected", the request will be completely unblocked.

ASM irule to disable attack signature authorization header with specific value

Enes_Afsin_Al
MVP
Apr 10, 2023
Hi f5learner,

Can you try this iRule?

when ASM_REQUEST_DONE { if { [ASM::violation names] contains "VIOLATION_ATTACK_SIGNATURE_DETECTED" && [HTTP::header Authorization] starts_with "Bearer" } { ASM::unblock } }

Trigger ASM iRule Events Mode should be set Normal on the WAF policy.

Note that if the request has any violations other than "attack signature detected", the request will be completely unblocked.
- f5learner
  Nimbostratus
  Apr 11, 2023
  thank you so much for response you mentioned
  "Note that if the request has any violations other than "attack signature detected", the request will be completely unblocked."
  how can I ensure that other violations are not completely unblocked and get assessed by other WAF rules. I only want to disable attack signatures on HTTP header authorization with value containing "Bearer" , the remaining payload and other requests should be evaluated as normal.
  
  Also in above syntax how can I also enable logging everytime authorization header containing Bearer bypasses.
  Thank you so much for your help
Enes_Afsin_Al
MVP
Apr 12, 2023
Hi,

Can you test this iRule?

when ASM_REQUEST_DONE { if { [ASM::violation names] eq "VIOLATION_ATTACK_SIGNATURE_DETECTED" && [b64decode [llookup [ASM::violation details] "header.header_name"]] eq "Authorization" && [HTTP::header Authorization] starts_with "Bearer" } { log local0. "Request unblocked - URI: [HTTP::uri] - ClientIP: [IP::client_addr] - Authorization: [HTTP::header Authorization]" ASM::unblock } }

With this iRule, the request will be unblocked only if occurs following conditions:

Only Attack signature violation occurs

Attack signature is in the Authorization header

Authorization header starts with Bearer

In all other cases, the blocking will continue.
You can view the logs in the /var/log/ltm.
- f5learner
  Nimbostratus
  Apr 12, 2023
  thank you so much, looks like we are almost there but still not working. is it because above provided irule ONLY expecting attack signature violation but there is also "Modified domain cookie" detection. However modified cookie is in ALARM mode. so should further modification needed? please see below screenshots
  - f5learner
    Nimbostratus
    Apr 14, 2023
    please let me know if you need furhter inforamtion, thank you so much for your assistance
Enes_Afsin_Al
MVP
Apr 16, 2023
Hi,

If a violation other than "Attack Signature Detected" occurs, it will not match the if statement in the iRule.

Could you try with "contains" instead of "equals" in the if statement?

when ASM_REQUEST_DONE { if { [ASM::violation names] contains "VIOLATION_ATTACK_SIGNATURE_DETECTED" && [b64decode [llookup [ASM::violation details] "header.header_name"]] eq "Authorization" && [HTTP::header Authorization] starts_with "Bearer" } { log local0. "Request unblocked - URI: [HTTP::uri] - ClientIP: [IP::client_addr] - Authorization: [HTTP::header Authorization]" ASM::unblock } }
- f5learner
  Nimbostratus
  Apr 18, 2023
  Thank you for your help
  
  by changing to CONTAINS allowed bypass for other violations in Blocking mode as well, for example I blacklisted my source IP but the request was allowed so that should not happen
  
  The flow could look like this
  
  Part one
  
  if ONLY violation name VIOLATION_ATTACK_SIGNATURE exist with Authorization header with value starts with Bearer - Unblock
  it can be achieved per your initial help with following if statement with eq
  
  if { [ASM::violation names] eq "VIOLATION_ATTACK_SIGNATURE_DETECTED" && [b64decode [llookup [ASM::violation details] "header.header_name"]] eq "Authorization" && [HTTP::header Authorization] starts_with "Bearer" }
  
  second part would be
  if ONLY violation name VIOLATION_ATTACK_SIGNATURE exist with Authorization header with value starts with Bearer (first part above) BUT ALSO ANY another violation exist BUT with ONLY Applied Blocking Settings Alarm and Learn or ALARM OR LEARN - then Unblock as well
  accomplishing second part above would also ensure that Part one above will not be impacted if other triggers are only in alarm/learn mode?
  - f5learner
    Nimbostratus
    Apr 20, 2023
    I am not sure if it is possible to be that granular? please let me know thank you for your help
Enes_Afsin_Al
MVP
Apr 20, 2023
Hi,

When more than one violation occurs, if "Block" is active in one violation, but not in the other violation, the request_status for ASM::violation_data does not occur individually. It is defined as "block".

A separate control is required for violations that are not in the block. I think, rather than using such an iRule, a simple policy should be preferred.

https://clouddocs.f5.com/api/irules/ASM__violation_data.html
- f5learner
  Nimbostratus
  Apr 25, 2023
  thank you so much for all the help