How to secure url on irule on F5?

Question

I need secure one think and i dont know how to do it correctly and properly.
We have this link on website for aplication: https://www.somewebsite.com/test/UI/Login?realm=external&goto=https://www.somewebsite.com/application/security_check&locale=en&service=client
After user authentication they are redirected to website in the link: https://www.somewebsite.com/application/security_check&locale=en&service=client

All works like should be... beut there is one small secure issue, when peoples in our organization get phishing attack email to change something in their account with different link in goto something like this and after login there is something for fill credit card numer it is problem...

https://www.somewebsite.com/test/UI/Login?realm=external&goto=https://www.somewebsite.com@www.hackerssite.com&locale=en&service=client

How to prevent this on F5 to secure goto? Via some irule and explicit links, or just block @ in link?

daniel_wolf · Answer

Hi&nbsp;locki,seems your app is vulnerable to open redirects. Take a look at the following links to learn more:OWASP Cheat Sheet Series - Unvalidated Redirects and Forwards&nbsp;MITRE - CWE-601: URL Redirection to Untrusted SitePortSwigger - Open redirection&nbsp;Can be fixed with ASM (BIG-IP v16.1):&nbsp;MyF5 &gt; BIG-IP Application Security Manager: Implementations &gt; Mitigating Open Redirects&nbsp;&nbsp;IMHO it should be fixed in the app code by your developers.KRDaniel

paulius · Answer

locki I believe what you are looking for is dealing with URI::query which you can read up more at the following link.
https://clouddocs.f5.com/api/irules/URI__query.html
In addition I believe someone did something similar in the following link.
https://community.f5.com/t5/technical-forum/irule-to-block-uri-with-parameters-irrespective-of-uri-query/td-p/216167
Is the F5 working as your perimeter device and does it have WAF enabled on it? I think this situation might be better dealt with by using WAF rather than relying on a manually created and updated iRule to protect the entirety of your user base.

locki · Answer

There is ASM on the box, on perimeter is FW then F5, I also think there must be better solution then some irule...

paulius · Answer

locki I defer to Daniel_Wolf comment which is a great option that seems like it would work for you.

Forum Discussion

How to secure url on irule on F5?

Recent Discussions

FQDN resolve in non default domain name.

APM - Capture Login sharepoint

APM : is VMware Workspace One supported as an Endpoint Management System?

K000136009 mount: /usr is busy

Inquiry About DGME Portal Access Issues

Related Content

iRULE regsub error

owa iapp assign irule

iRule assistance for subfolder redirect

Select different security policy depending on host name

Irule Trigger two times