Disabling ASM attack signature for file upload

Question

Hello,We have an application where customers may attach files when they submit an enrollment.&nbsp; Sometimes the upload of these files are being blocked by our ASM policy because they are similar to a regex expression.&nbsp; Our IPS team who manages the ASM tried to create an allow URL and add the parameter for the file upload but said this wasn't working because at this level you can only block parameter level attack signatures.&nbsp; The signatures we're trying to block isn't a parameter level attack signatures.&nbsp; Any suggestions?

enes_afsin_al · Answer

Hi SteveD1979,
The request body handling control can be disable by checking on the content-type or a different specific header value.

"Content-type: multipart/form-data" header is sent on file upload. It may has a different value based on the application.

steved1979 · Answer

Thanks for your reply.&nbsp; Does the 'Do nothing" option allow the customer to upload the file but keep the security policy in place for the URL?&nbsp; Or would we want to do the form data or another option?

mohamed_salah_ · Answer

can you share the ASM violation that matches with the upload requests?

steved1979 · Answer

The violation is attack signature detected Generic buffer overflow attempt 27 signature ID 200011026

afr_jn · Answer

If the Content-Type matches to multipart/form-data (or: spesific file upload) for spesific URL, the body handling will do nothing. If the Content-Type does not mathes to multipart/form-data, such as Content-Type: text/html; charset=UTF-8, the body handling will apply value and content signatures.

Forum Discussion

Disabling ASM attack signature for file upload

Recent Discussions

Big-iq 8.2 questions

[APM] - Error: failed to reset strict operations; disconnecting from mcpd

What is the use of epsec-package file in APM ?

201 Recommendations for Study

URL redirect

Related Content

Mitigating JSON-based SQL injection with BIG-IP ASM / Advanced WAF Attack Signatures

ASM irule to disable attack signature authorization header with specific value

Wildcard Parameter signature attack

Live Update- ASM attack signatures

Default Attack Signature Sets