For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

imac_105647's avatar
imac_105647
Icon for Nimbostratus rankNimbostratus
Jan 06, 2010

XML comment triggers an attack signature

Hello,     Can anyone tell me why a comment in an XML POST is seen as an attack?     The only thing I've found so far is the use of comments to help generating the correct checks...
app sec
BIG-IP Access Policy Manager (APM)
security
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Jan 06, 2010
Hi,

 

 

The Comments 2 attack signature is matching on XML/HTML comments as comments could potentially be used to obfuscate attacks. If your app accepts / requires comments in the XML, you'd want to disable this check either for the entire policy, just one object or a single parameter if the XML is passed in a parameter.

 

 

If you'd like more details on the logic for including this signature in the attack sigs, you could open a case with F5 Support.

 

 

Aaron