Forum Discussion

lnxgeek's avatar
May 19, 2018

XML base64 namespace and attack signatures

I have a XML/SOAP application where ASM causes a high number of false positives on the attack signatures.

 

The main culprit is a namespace which is base64 encoded (embedded picture) where the combination of characters often matches a signature.

 

Is there a way to disable/unblock signatures when they creates a violation on this specific namespace?

 

I was thinking of fixing up an iRule but I don't know how to make the match between the namespace and a signature violation.

 

  • do you have a XML profile attached? does it recognize the name space as variable?

     

  • Hmm didn't think of that.

     

    I've only used the WSDL file.

     

    I still don't see how I can match the signature violation with the element?