For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

svs's avatar
svs
Icon for Cirrostratus rankCirrostratus
Sep 28, 2016

ASM Violation "HTTP Header Injection"

Hi Folks,   in the last days I saw the violation "HTTP Header Injection" very often in my manual traffic learning. When looking at the request I can't really understand, what causes this violation...
ASM Advanced WAF
security
Tikka_Nagi_1315's avatar
Tikka_Nagi_1315
Historic F5 Account
Sep 29, 2016

Without seeing the actual HTTP Request it's difficult to answer this question. You could open a support case and provide the details.

 

The violation 'HTTP Header Injection' is triggered by Signature ID 200018023. You can disable the signature 200018023 and customize a new signature to allow “0xa” and “0xd”. Please refer to the manual chapter: https://support.f5.com/kb/en-us/products/big-ip_asm/manuals/product/asm-config-11-3-0/asm_attack_sigs.html?sr=474886781031942