Hi, Based on Microsoft's snort signature: http://blogs.technet.com/b/srd/archive/2011/12/27/more-information-about-the-december-2011-asp-net-vulnerability.aspx Please comment on or verify the following iRule: This irule checks for HTTP POST, that contains "application/x-www-form-urlencoded" Then it collects the HTTP payload data and tries to matches it with Microsoft's snort signature Logs the local.alert , client IP and Port and HTTP uri when HTTP_REQUEST { if { [HTTP::method] equals "POST" }{ set clength 0 if {[HTTP::header exists "Content-Length"] && [HTTP::header Content-Length] 0 && [HTTP::header Content-Type] contains "application/x-www-form-urlencoded"}{ set clength [HTTP::header Content-Length] } else { set clength 1048576 } if { [info exists clength] && $clength > 0} { HTTP::collect $clength } } } when HTTP_REQUEST_DATA { if {[HTTP::payload] matches_regex "/(\w*(&|=)){1000,}/smi"} { log local0.alert "Microsoft Security Advisory (2659883) IP Address [IP::client_addr]:[TCP::client_port] \ requested [HTTP::uri]" } } Thanks, Peter

Hi Peter, I'm not sure you can use the {1000,} count syntax with TCL or iRules. Regardless, a string pattern should be more efficient than a regex. Here's an untested example: when RULE_INIT { We want to check the payload for 500 or more parameter=value pairs set static::pattern "[string repeat *& 500]*" } when HTTP_REQUEST { Collect up to 1Mb of POST data if { [HTTP::method] equals "POST"}{ set clength 0 if {[HTTP::header "Content-Length"] ne "" && [HTTP::header "Content-Length"] <= 1048576 }{ set clength [HTTP::header Content-Length] } else { set clength 1048576 } if { $clength > 0} { HTTP::collect $clength } } } when HTTP_REQUEST_DATA { Check if the collected payload matches the pattern if {[HTTP::payload] matches_glob $static::pattern} { log local0.alert "Microsoft Security Advisory (2659883)\ IP Address [IP::client_addr]:[TCP::client_port] requested [HTTP::uri]" Drop the request drop } } Aaron

You could be a little more dynamic in finding the occurrences of "&": % set x [string repeat {&23456} 5] &23456&23456&23456&23456&23456 % puts [expr [llength [split $x "&"]] -1] 5

I like that... I'm guessing it's more efficient and it's definitely more elegant. Also, I think most web apps don't normally use more than a 100 parameters for a single page. So basically you could do something like this: when HTTP_REQUEST { Collect up to 1Mb of POST data if { [HTTP::method] equals "POST"}{ set clength 0 if {[HTTP::header "Content-Length"] ne "" && [HTTP::header "Content-Length"] <= 1048576 }{ set clength [HTTP::header Content-Length] } else { set clength 1048576 } if { $clength > 0} { HTTP::collect $clength } } } when HTTP_REQUEST_DATA { Check if the collected payload contains more than 100 parameters if { [llength [split [HTTP::payload] &]] > 100 } { log local0.alert "Microsoft Security Advisory (2659883)\ IP Address [IP::client_addr]:[TCP::client_port] requested [HTTP::uri]" Drop the request drop } } Aaron

Thank you Aaron & Jason for your tweaks and great suggestions! Very Much Appreciated! Peter

iRule to log for Microsoft Security Advisory (2659883) Vulnerability in ASP.NET Could Allow Denial of Service?

Forum Discussion

Recent Discussions

SSL Forward Proxy, iRules and Client Hello

monitor/healthcheck issue with envoy gateway

Recommendation for Adv. Lab

Changes to DO and AS3 GitHub - no longer monitored

How to Verify config before loading to F5

Related Content

CVE-2021-26855 (SSRF) HAFNIUM APT Group Exploiting Microsoft Exchange Vulnerabilities

Microsoft Powershell with iControl

OpenSSH vulnerability

Mitigating Log4j Vulnerability using F5 BIG-IP

Microsoft SharePoint and Microsoft Exchange December 2020 Security Update