Forum Discussion

L-CISIRH-BT-NET's avatar
L-CISIRH-BT-NET
Icon for Nimbostratus rankNimbostratus
Nov 02, 2018

CSRF protection blocks the whole website instead of csrf attacks only

Hi everybody Working on a VE 11.5.4 I need to activate the CSRF protection that my application does not provide.

 

The pb is that once activated, ASM blocks everything instead of a real attack. So the website becomes blocked by ASM. Thus, it looks like every navigation on the website is a false positive.

 

I also noticed in the response pages that the code inserted looks like put in comment and I wonder if it's supposed to be commented or if there's a bug out there :

 

Does anyone get a hint ?

 

ASM Advanced WAF
security
  • L-CISIRH-BT-NET's avatar
    L-CISIRH-BT-NET
    Icon for Nimbostratus rankNimbostratus
    Nov 02, 2018

    the code i mentionned is : !-- csrf = { pn : "csrt", pv : '18196769039293321355', vh : [ ], vu : [ /^\/(.\/).$/ ], f : 0, f_cancel_onload : 0 }; if (typeof is_ajsp_running == "undefined") { is_ajsp_running = false; } //--

     

  • samstep's avatar
    samstep
    Icon for Cirrocumulus rankCirrocumulus
    Nov 04, 2018

    First of all you need to make use you use CSRF only on URLs which need it (have CSRF vulnerability e.g. transactions) and these URLs to the Protected URLs list in ASM CSRF screen.

     

    Secondly:

     

    Version 11.5.4 has a known CSRF bug (ID474256) causing False Positive, more information here

     

    https://cdn.f5.com/product/bugtracker/ID474256.html

     

    So if you are affected (CSRF protection is needed in frames) then you need to upgrade to v12.x