Forum Discussion
Robinchien_3128
Nimbostratus
Mar 07, 2017How to fix apache struts2 s2-045 vulnerable with f5 irule ?
How to fix apache struts2 s2-045 vulnerable with f5 irule ?
John_Alam_45640
Mar 09, 2017Historic F5 Account
The Vulnerability has to do with File upload so, no use checking every single request.
This is why my iRule on codeshare inspects the Content-Type for POST requests only.
when HTTP_REQUEST {
if { [HTTP::method] equals "POST" } {
if { not ( [HTTP::header Content-Type] equals "multipart/form-data" or [HTTP::header Content-Type] equals "application/x-www-form-urlencoded" or [HTTP::header Content-Type] equals "text/plain" ) } {
reject
log local0. "Rejecting a POST request with Content-type [HTTP::header Content-Type] to [HTTP::uri] from [IP::client_addr]"
}
}
}
One could restrict this further by matching against the URL(s) which present the upload form:
when HTTP_REQUEST {
if { [HTTP::uri] equals "" } {
if { not ( [HTTP::header Content-Type] equals "multipart/form-data" or [HTTP::header Content-Type] equals "application/x-www-form-urlencoded" or [HTTP::header Content-Type] equals "text/plain" ) } {
reject
log local0. "Rejecting a POST request with Content-type [HTTP::header Content-Type] to [HTTP::uri] from [IP::client_addr]"
}
}
}
- Kai_WilkeMar 31, 2017
MVP
This answer shouldn't be marked as answer. Its breaking applications and also not covering all attack vectors.
Cheers, Kai
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects