Forum Discussion

f5learner's avatar
f5learner
Icon for Nimbostratus rankNimbostratus
Apr 10, 2023

ASM irule to disable attack signature authorization header with specific value

hello is there an irule to DISABLE ASM attack signature on the Authorization header if value contains "Bearer" but still check attack signature on rest of the payload
devops
security
  • Enes_Afsin_Al's avatar
    Enes_Afsin_Al
    Apr 10, 2023

    Hi f5learner,

    Can you try this iRule?

    when ASM_REQUEST_DONE {
    if { [ASM::violation names] contains "VIOLATION_ATTACK_SIGNATURE_DETECTED" && [HTTP::header Authorization] starts_with "Bearer" } {
        ASM::unblock
    }
}

    Trigger ASM iRule Events Mode should be set Normal on the WAF policy.

    Note that if the request has any violations other than "attack signature detected", the request will be completely unblocked.

  • Enes_Afsin_Al's avatar
    Enes_Afsin_Al
    Apr 20, 2023

    Hi,

    When more than one violation occurs, if "Block" is active in one violation, but not in the other violation, the request_status for ASM::violation_data does not occur individually. It is defined as "block".

    A separate control is required for violations that are not in the block. I think, rather than using such an iRule, a simple policy should be preferred.

    https://clouddocs.f5.com/api/irules/ASM__violation_data.html

Enes_Afsin_Al's avatar
Enes_Afsin_Al
Icon for MVP rankMVP

Hi,

If a violation other than "Attack Signature Detected" occurs, it will not match the if statement in the iRule.

Could you try with "contains" instead of "equals" in the if statement?

when ASM_REQUEST_DONE {
    if { [ASM::violation names] contains "VIOLATION_ATTACK_SIGNATURE_DETECTED" && [b64decode [llookup [ASM::violation details] "header.header_name"]] eq "Authorization" && [HTTP::header Authorization] starts_with "Bearer" } {
        log local0. "Request unblocked - URI: [HTTP::uri] - ClientIP: [IP::client_addr] - Authorization: [HTTP::header Authorization]"
        ASM::unblock
    }
}

 

f5learner's avatar
f5learner
Icon for Nimbostratus rankNimbostratus
Apr 18, 2023

Thank you for your help 

by changing to CONTAINS allowed bypass for other violations in Blocking mode as well, for example I blacklisted my source IP but the request was allowed so that should not happen

The flow could look like this

Part one

if ONLY violation name VIOLATION_ATTACK_SIGNATURE exist with Authorization header with value starts with Bearer - Unblock
it can be achieved per your initial help with following if statement with eq

if { [ASM::violation names] eq "VIOLATION_ATTACK_SIGNATURE_DETECTED" && [b64decode [llookup [ASM::violation details] "header.header_name"]] eq "Authorization" && [HTTP::header Authorization] starts_with "Bearer" }

second part would be

if ONLY violation name VIOLATION_ATTACK_SIGNATURE exist with Authorization header with value starts with Bearer (first part above) BUT ALSO ANY another violation exist BUT with ONLY Applied Blocking Settings Alarm and Learn or ALARM OR LEARN - then Unblock as well

accomplishing second part above would also ensure that Part one above will not be impacted if other triggers are only in alarm/learn mode?

  • f5learner's avatar
    f5learner
    Icon for Nimbostratus rankNimbostratus
    Apr 20, 2023

    I am not sure if it is possible to be that granular? please let me know thank you for your help