For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Akhtar_109015's avatar
Akhtar_109015
Icon for Nimbostratus rankNimbostratus
May 01, 2014

File upload Restriction on ASM

Hello All,   Is there any way to restrict file types to be uploaded tied to specific parameter ? So our website is having a Resume upload field, so I want to know if I can limit the files types re...
ASM Advanced WAF
deployment
security
Mike__Maher_108's avatar
Mike__Maher_108
Icon for Nimbostratus rankNimbostratus
May 01, 2014

So yes you can do this, but not in the area that you have mentioned. Allowed File types is checking the file extension on the URL, not a parameter or its value. So based upon what you are saying, in Allowed File Types you need to allow for aspx, then I am assuming that the file name is a value of a parameter being passed. So what you want to do is go define that parameter set it up as a Parameter Value Type of User Input with a Data Type of Alpha-Numeric parameter, and then use a Reg Ex to control the file type. Here is what I am using, not sure if that is the best way but I am not a Reg Ex wizard by any means :)

 

(?i).(txt|pdf|doc|docx|csv|xls|xlsx|jpg|png|gif|jpeg|tiff|tif|ppt|pptx)$

 

I also assume there is another parameter that contains the actual file upload itself. You want to create that Parameter, and set it up as a Parameter Value Type of User Input with a Data Type of File Upload, you can also disallow .exe files from here. Then if you have an AV scan Engine server, I would also recommend using the AV protection integration to offload that file as it passes through the ASM to be AV scanned. Check the configuration guide for steps on how to set it up (link below).

 

https://support.f5.com/kb/en-us/products/big-ip_asm/manuals/product/asm-config-11-4-0/asm_sys_mgmt.html?sr=370424701037564

 

Hope that covers your question.

 

  • xunil321_122934's avatar
    xunil321_122934
    Icon for Nimbostratus rankNimbostratus
    Dec 02, 2014
    Sorry for my ignorance! Does this also mean that only files with the extensions mentioned above could be DOWNLOADED? If yes is there any way by the ASM to allow downloading ALL types of files and to deny uploading ANY file?
  • fweiss_174951's avatar
    fweiss_174951
    Icon for Nimbostratus rankNimbostratus
    May 12, 2015
    You could disallow the method "Post" and "Put". You could downsize long_request_buffer_size and work with "Request length exceeds defined buffer size" . You could disallow URLs and Upload-Parameters. As shown above you could use regex to specify which filename/extension is allowed to be uploaded (filename in parameter value). You could write a signature triggering on any part of a request, e.g. the filename part. Content-Disposition: form-data; name="uploadedfile"; filename="hello.o" Choose your flavor.