For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

david_berg_3177's avatar
david_berg_3177
Icon for Nimbostratus rankNimbostratus
Nov 24, 2018

no signature id in blocked request and no accept button available

hi everyone i have an issue with f5 logging. i have a request that is blocked, but no attack signature id is available in request log. attack type is path traversal and Violation Rating is Request is...
ASM Advanced WAF
security
david_berg_3177's avatar
david_berg_3177
Icon for Nimbostratus rankNimbostratus
Nov 27, 2018

but threre is no directory traversal in uri:

 

POST /Module/Template/Item/DataItem.aspx?SiteId=d358f6f2-0g23b-4be0-857e-a11b763fb7bd&WebpartId=e02541c7-eccf-4d96-8bf2-ac352bfa367 HTTP/1.1

 

there is no violation name available above the URL in request log and i cant determine which violation has occurred.see screenshot below:

 

 

  • Simon_Blakely's avatar
    Simon_Blakely
    Icon for Employee rankEmployee
    Nov 27, 2018

    Is the POST content a multipart form or file upload?

     

    File upload elements can have paths as well.

     

    You will probably get a better result by raising a support ticket with F5, so the engineer can review the actual violation and policy.