Forum Discussion
AltostratusHow to tuning policy WAF F5 for Command Execution
Hi TsukiAzuma ,
would you please share the violation that F5 WAF produce it against this request.
AltostratusIt mean that ?
violations="Illegal meta character in value,Attack signature detected",support_id="6258108010622842152",request_status="blocked",response_code="0",ip_client="xxx",route_domain="0",method="POST",protocol="HTTPS",query_string="",x_forwarded_for_header_value="xxx, xxx",sig_ids="200003086",sig_names="%22vi%22 execution attempt",date_time="2022-12-07 15:32:38",severity="Error",attack_type="Abuse of Functionality,Command Execution",geo_location="N/A",ip_address_intelligence="N/A",username="N/A",session_id="d080b92a930b4a2",src_port="xxx",dest_port="xxx",dest_ip="xxx",sub_violations="",virus_name="N/A",violation_rating="2",websocket_direction="N/A",websocket_message_type="N/A",device_id="N/A",staged_sig_ids="",staged_sig_names="",blocking_exception_reason="N/A",captcha_result="not_received",uri="/login"
Hi TsukiAzuma ,
Try to define the impacted url and its parameters as an explicit entity in allowed urls , after that allow the attack signature that blocks your requests to this url and the same thing with meta characters under this url parameter , allow the meta character that blocks you when this request come to F5.
I will send some snapshot from my lab will help :
1- Create explicit url " /login " with POST method :> get the attack signature ID and search in " Global security policy setting bar " by this ID and drag it from Right table to Left , by this way you allowed this attack signature under this url only.
2- After that create your parameters that come with this url , in " POST " data and allow the meta character , you can do this by selecting Url Parameters TAB in the last snap shot and proceed :> After doing that , your Request shoudn’t be blocked.
> Note , I do not know what are your parameters under this requested url , you should know them and able to add this impacted parameter such as last snap shot.> Read this Article Carefully , it will show you more :
https://support.f5.com/csp/article/K64208044
I hope this helps you.
Regards- TsukiAzuma
Thank you.
I will contact with network team and try it
Hi TsukiAzuma ,
1. You must decide which meta characters is allowed for the parameters.
2. If you accept suggestion for wildcard parameters illegal meta characters would be accepted for all parameters but not for particular learned parameters.
3. Allowed: Specifies that the character or meta character can occur in parameter values. Disallowed: Specifies that the character or meta character can not occur in parameter values.
4. This settings came from /Security/Application Security/Parameters/Characters Sets
Do you have any records about violation?
Security ›› Application Security : Policy Building : Violations on Entities : Violations on Parameters
A legitimate parameter value has been blocked due to a disallowed character. This is considered a false positive.
Recommended Actions
To allow a meta character value at the parameter level, go to:
Security >> Application Security : Parameters : Parameters List >> <parameter> >> Value Meta Characters
Alternatively, for all parameters, this may be configured at:
Security >> Application Security : Parameters : Character Sets : Parameter Value
>> Apply your policy>> Test again
Share your test reults again with me.
refer this link:
K6787: Working with metacharacters in the BIG-IP ASM security policy
https://support.f5.com/csp/article/K6787https://f5-agility-labs-waf.readthedocs.io/en/latest/class5/module1/lab4/lab4.html
HTH
