Mitigating Stored XSS Attacks with F5 Big-IP ASM: Insights Needed

Question

Hello Everyone,&nbsp;Could someone provide insights into how F5 Big-IP ASM handles stored XSS attacks?&nbsp;&nbsp;My understanding is that ASM primarily focuses on inspecting and enforcing XSS signature sets on incoming requests. However, stored XSS attacks involve legitimate requests but malicious scripts embedded in server responses.&nbsp;&nbsp;While attempting to enforce ASM's XSS signature set on server responses seems impractical, I'm curious if ASM has the capability to analyze and mitigate XSS vulnerabilities within server responses.&nbsp;&nbsp;&nbsp;Can anyone shed light on this aspect of F5 ASM's functionality?"

daniel_wolf · Answer

Hi Nishal_Rai,
ASM compares the request or response against the attack signatures associated with your security policy. If a matching pattern is detected, ASM triggers an Attack signature detected violation, and either alarms or blocks based on the enforcement mode of your security policy.See here: https://techdocs.f5.com/en-us/bigip-14-1-0/big-ip-asm-attack-and-bot-signatures-14-1-0/assigning-attack-signatures-to-security-policies.html
I don't have DVWA running atm to test your case, but I'm confident this will work.
KRDaniel

amine_kadimi · Answer

Hi,
&nbsp;
If it is stored XSS, then it probably got stored previously following a bad request from an attacker, this request should have been blocked. If an attacker can bypass ASM to send the malicious payload, then it might be a bad signatures configuration. Can you provide more details on the scenario if I'm wrong?

nishal_rai · Answer

Hi Daniel &amp; Amine,Actually, I've been testing stored XSS payloads on DVWA, bypassing F5 ASM, and requesting via F5 AWAF. Like trying to create a scenario when the client is unaware that there application has been affected by the stored xss payload.&nbsp;Wondering if F5 ASM can detect and block responses containing these payloads from affected servers. Any insights?

amine_kadimi · Answer

I suggest you enable signature enforcement for server responses. In a lab environment it should be OK but in production it might impact the performance of the app

daniel_wolf · Answer

Yes, that's what I said. Signatures can be enforced also on responses.

Forum Discussion

Mitigating Stored XSS Attacks with F5 Big-IP ASM: Insights Needed

Recent Discussions

Outlook application issue

Why does WAF block HTTP OPTION method

Rewriting Location Header in iRule

HA Configuration (One in primary and One in DR)

Sending a trusted certificate to server

Related Content

Mitigating JSON-based SQL injection with BIG-IP ASM / Advanced WAF Attack Signatures

Mitigating OWASP Web Application Risk: SSRF Attack using F5 XC Platform

Announcing Security Insights

Mitigating OWASP Web Application Risk: Broken Access attacks using F5 Distributed Cloud Platform

The HTTP/2 CONTINUATION frame attack