For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Lyonsy_271608's avatar
Lyonsy_271608
Icon for Altocumulus rankAltocumulus
Nov 23, 2016
Solved

WAF Blocking templates on upload

Hi Guys   Have an issue with templates (html and css) being uploaded to a certain url detects them and blocks as Cross Site Scripting (XSS), Detection Evasion, Other Application Attacks, SQL-Inj...
BIG-IP
iRules
security
  • Lyonsy_271608's avatar
    Lyonsy_271608
    Nov 25, 2016

    when HTTP_CLASS_SELECTED { ASM::enable if { [HTTP::uri] starts_with "/*****" } { ASM::disable } }

     

boneyard's avatar
boneyard
Icon for MVP rankMVP
Nov 25, 2016

ah still version 10? or older version 11? have a look at upgrading.

 

do understand this disables all ASM protection, so not just a few signatures disabled but everything.

 

it might be better to change ASM policy based on URI, that way you keep some protection at least.