multipart/form-data

We have several applications which allow the customer to upload files (pdf, doc, ppt, ...) to our servers. Those uploads are performed by multipart/form-data POST requests.

Since a while we notice that our ASM (10.2.4 HF4 with the latest attack signatures) does detect (and block) one or another attack signature in a document being uploaded. The detected "attacks" are generic signatures such as ID 200011005, 200007001, 200100012.

ASM should not apply the attack signature processing to those uploaded files. I tried to achieve this by disabling the multipart HTTP Protocol Compliance checks, by defining an 'ignore value' or 'user input - binary' wildcard parameter (I tried both global and URL type), by defining an explicit URL with ignore wildcard parameter, by defining an explicit 'ignore value' parameter, ... Neither of these solved the problem.

Askf5 does not contain useful information on this topic. I also compared the multipart/form-data POST requests with the RFCs, and the POST syntax seems to be correct.

Only disabling the attack signatures helps, but this is not a scalable solution, does annoy both our customers and our business staff, and is unsecure (as the signature is then disabled for all user traffic for these applications).

Does anyone know a better solution for this problem?

Thanks,

Ivo