For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Dave_Pisarek_25's avatar
Dave_Pisarek_25
Icon for Nimbostratus rankNimbostratus
Nov 02, 2017

SQL Injection signature set on policy - odd behavior

I have noticed an odd behavior for a policy I created in 12.1.2 ASM. The policy was created manually through the deployment wizard with the following settings   utf-8 no template selected, no case...
ASM Advanced WAF
security
Simon_Blakely's avatar
Simon_Blakely
Icon for Employee rankEmployee
Nov 03, 2017

It looks to me like the primary request is not detected and blocked.

 

The page renders HTML, but all subsequent linked requests for CSS and Images include the referrer - which does trigger the signatures and is blocked.

 

Turn on logging for all requests - you should see what is happening with the first request.