Forum Discussion

Dave_Pisarek's avatar
Dave_Pisarek
Icon for Cirrus rankCirrus
May 19, 2021

XFF and sleep

Recently I was asked about mitigating the below XFF header:   X-Forwarded-For: (select(0)from(select(sleep(5)))v)/*'+(select(0)from(select(sleep(5)))v)+'"+(select(0)from(select(sleep(5)))v)+"*/   ...
ASM Advanced WAF
BIG-IP
security
Daniel_Wolf's avatar
Daniel_Wolf
Icon for MVP rankMVP
May 19, 2021

Hi Dave,

 

you can block this by enforcing Attack Signature ID 200000074 (SQL-INJ "end-quote select" (Headers)).

Another approach could be to use an iRule or LTM Policy to scrub any XFF header from the HTTP Request. Unless there is a device in front of the BIG-IP that would insert such header, why would a client send a XFF header...

 

KR

Daniel