For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

MSZ_221163's avatar
MSZ_221163
Icon for Nimbostratus rankNimbostratus
Dec 11, 2018

Host Header Poisoning

Here I am showing some of the Headers from the request. The Host Header contains the MALICIOUS/UNWANTED alphabets before domain name/host name. How it is possible to block such requests on ASM?   ...
ASM Advanced WAF
BIG-IP
security
youssef1's avatar
youssef1
Icon for Cumulonimbus rankCumulonimbus
Dec 11, 2018

Hi,

 

You can use ASM policy to block invalid host headers: (response from: René Geile)

 

https://devcentral.f5.com/questions/asm-policy-not-blocking-invalid-host-headers-58747

 

you allways need two parts for ASM features:

 

  • Configure the feature (i.e. define valid Host Headers, define valid methods)

     

  • Configure Blocking/Learning/Alerting for the violations of the features.

     

See Security- Application Security : Policy Building : Learning and Blocking Settings

 

Section "HTTP Compliance": Enable blocking. Enable all host header related subitems in this section. (Bad Host Header value, Host header contains an IP address...)

 

Section "headers" : Enable "blocking" for violation "illegal methods"