Forum Discussion
NimbostratusAWS F5_OWASP Managed Rule Blocking requests
AWS F5 OWASP managed rules are blocking requests all of a sudden (23-01-2025) We want to understand if there was any update made and also the changelog for this update and which rules were updated. Where do I find this information and AWS is not supporting these rules since these are managed by F5. Do we have a way to reach the vendor ?
5 Replies
sophie8989Altostratus
great query i am also waiting for the answer for this query
cchanfcccOur applications took a 1.5 hour downtime in all environments today. The following rules were triggered:
rule_Union_Based_AllQueryArguments_Body
rule_Blind_Boolean_Time_Based__AllQueryArguments_Body
rule_Unicode_AllQueryArguments_Body
I need information about what was changed by F5 in the rules so I can determine if these are legitimate issues the development team needs to address or false positives, and how to be proactive about these in the future.
SivaGEmployee
We are looking into the issue, we will get back ASAP.
- SivaG
We implemented an incremental region-based update to the rules. However, after receiving reports of false positives, we rolled back the changes on the morning of 1/27 EST. Currently, we are working on fine-tuning and adjusting the rules, and we will share an update before deploying them again. In the meantime, we kindly request you to share the false positive data, as it will be helpful for further investigation and refinement. We apologize for the disruption caused to the service.
marianishanthhi SivaG​ ,
Thanks for the update. We would like to know when these rules will get updated. If not for a notification, we would like a link to the changelog so that we can determine why this is happening. Can you provide a link for the change log/version update of these rules?
I will not be able to share any data, but these are the rules that were blocking the requests.rule_JS_Events_AllQueryArguments_Body
rule_Unicode_AllQueryArguments_Body
