Forum Discussion

THE_BLUE's avatar
THE_BLUE
Icon for Cirrostratus rankCirrostratus
Oct 05, 2021

Can't upload msg file - ASM block

WAF block my request due to " attack signature detected" when try to upload msg file , and the Context : HTTP Request Body Unparsed Payload.

the request is look like this :

Content-Type: multipart/form-data;

Content-Disposition: form-data; name="sth.msg" fileName="sth.msg"

the name of parameter take the same name of file upload with each request, so how can we solve this?

  • This looks correct, though I don't have any lab where I could test this at the moment.

    Your configuration would apply anytime the Content-Type header value is multipart/form-data.

    The Request Header Value allows wildcards. You could try to narrow down to Do Nothing only for .msg files by testing this combination:

     

    Request Header Name : Content-Disposition

    Request Header Value : form-data; name="*.msg"; filename="*.msg"

    Request Body Handling : Do Nothing

     

    EDIT: A word of caution. You should consider to what risk you are exposing your application when not checking these uploads.

  • This looks correct, though I don't have any lab where I could test this at the moment.

    Your configuration would apply anytime the Content-Type header value is multipart/form-data.

    The Request Header Value allows wildcards. You could try to narrow down to Do Nothing only for .msg files by testing this combination:

     

    Request Header Name : Content-Disposition

    Request Header Value : form-data; name="*.msg"; filename="*.msg"

    Request Body Handling : Do Nothing

     

    EDIT: A word of caution. You should consider to what risk you are exposing your application when not checking these uploads.

    • THE_BLUE's avatar
      THE_BLUE
      Icon for Cirrostratus rankCirrostratus

      Many thanks, i will test that.

      Thanks for the note, sure I will.

    • THE_BLUE's avatar
      THE_BLUE
      Icon for Cirrostratus rankCirrostratus

      Dear Daniel,

      Many thanks for sharing.

      For Request Header Name, enter an explicit header name that must appear in requests for this URL.

       

      so in my case i have to do like this :

      Request Header Name : Content-Type

      Request Header Value : multipart/form-data;

      Request Body Handling : Do Nothing

  • I have test that but still the same issue is still exist.

    • As said, I don't have a lab that I could use to test your particular case.

      Did you try with this combination too?

       

      Request Header Name : Content-Type

      Request Header Value : multipart/form-data;

      Request Body Handling : Do Nothing

       

      Maybe the Request Header Value is just not matching with the wildcards?

  • The strange thing is that I as well may test this solution as I have a query paramater in a POST request (strange yup !) that is for file upload with Content-Type: application/xxxx but F5 ASM/AWAF still is trying to inspect the body and thinks that the file body is another Parameter name and I get "Failed to convert character" and "HTTP protocol compliance failed", so making the query parameter of type file upload just can't stop the F5 to try to understand the body and try to check it 😁