For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Justin_48142's avatar
Justin_48142
Icon for Nimbostratus rankNimbostratus
Apr 10, 2008

Block URI with /dev60cgi from external client_addr

Hello,     I'm new to F5/iRules and I have a requirement to block external ip's from invoking any /dev60cgi/f60cgi URI call that doesn't include the string 'DRECSINHIST' or 'DRECSFFEDBF'. The i...
application delivery
dev
devops
iRules
Justin_48142's avatar
Justin_48142
Icon for Nimbostratus rankNimbostratus
Apr 10, 2008
FYI...here's what the LTM log shows when someone accesses an unauthorized form from an external ip address

 

 

Thu Apr 10 16:28:12 CDT 2008 tmm tmm[1661] Rule oracle_formservlet_filter HTTP_REQUEST: URI requested = /dev60cgi/f60cgi?appletmode=nonformsHTMLpageTitle=HTMLpreApplet=code=oracle/apps/fnd/formsClient/FormsLauncher.classwidth=400height=100archive=/OA_JAVA/oracle/apps/fnd/jar/fndforms.jar,/OA_JAVA/oracle/apps/fnd/jar/fndformsi18n.jar,/OA_JAVA/oracle/apps/fnd/jar/fndewt.jar,/OA_JAVA/oracle/apps/fnd/jar/fndswing.jar,/OA_JAVA/oracle/apps/fnd/jar/fndbalishare.jar,/OA_JAVA/oracle/apps/fnd/jar/fndaol.jar,/OA_JAVA/oracle/apps/fnd/jar/fndctx.jar,/OA_JAVA/oracle/apps/fnd/jar/fndlist.jargp14=jinit_appletcachegv14=offjinit_appletcache=offgp2=resp_appgv2=FNDgp3=respgv3=APPLICATION_DEVELOPERgp4=sec_groupgv4=STANDARDgp5=functiongv5=FND_FNDPOMPOgp6=other_paramsgv6=gp7=forms_urlgv7=https3A2F2Fhostname.domainname.com3A4432Fpls2Fnaoatst12Ffnd_icx_launch.runforms3FICX_TICKET3D26resp_app3DFND26resp_key3DAPPLICATION_DEVELOPER26secgrp_key3DSTANDARD26start_func3DFND_FNDPOMPO26other_params3Dencoding=UTF-8gp8=error_urlgv

 

Thu Apr 10 16:28:12 CDT 2008 tmm tmm[1661] Rule oracle_formservlet_filter HTTP_REQUEST: URI requested by 66.xxx.xxx.xxx blocked