Forum Discussion

Aurel's avatar
Aurel
Icon for Cirrus rankCirrus
Mar 26, 2019

ASM: Wrong charset on policy, what's the impact ?

Hello,

 

An UTF-8 encoding/charset application is protected by ASM, on which the policy has been set to another one : iso-8859-15.

 

I am considering to set a new policy with the proper charset on ASM, but i am being challenged about the real issues of the charset already set (iso-8859-15). I am curious about that and would like to clarify on how ASM could behave and either block "false" false positive and then finally requires permissive exceptions.

 

ASM Advanced WAF
security
  • Erik_Novak's avatar
    Erik_Novak
    Icon for Employee rankEmployee
    Mar 27, 2019

    ASM must know the character set so it can evaluate requests based on the correct encoding. It checks if the byte sequence is correct for the specified application language. Attack signatures are useless if the application language is incorrect and learning suggestions would be meaningless.

     

  • Erik_Novak's avatar
    Erik_Novak
    Icon for Employee rankEmployee
    Mar 28, 2019

    You are better off creating a new policy with the new character set. For both UTF-8 and iso8859-15 encodings, undefined characters will be disallowed and you will get a failed to convert character violation, even if some of the lower characters have the same encoding. However, if configured with ISO-8859-8 and receiving UTF-8 data, ASM will try to understand the stream both as ISO-8859-8 and if it fails, will also try UTF-8. IF you absolutely can't change the application language, is it possible to selectively disable the attack signature being triggered?