Technical Articles
F5 SMEs share good practice.
Showing results for 
Search instead for 
Did you mean: 
Custom Alert Banner
F5 Employee
F5 Employee

In the recent days Drupal released a security advisory regarding a new highly critical risk vulnerability affecting Drupal 8 instances. The vulnerability may allow unauthenticated users to execute arbitrary code by forcing the vulnerable Drupal 8 instance to unserialize an arbitrary PHP serialized object via a crafted request to a REST API endpoint. The exploited API endpoint is accessible to unauthenticated users by default on instances where the RESTful Web Services module is enabled.

Mitigating the vulnerability with BIG-IP ASM

BIG-IP ASM customers under any supported BIG-IP version are already protected against this vulnerability. The exploitation attempt will be detected by existing PHP code injection attack signatures which can be found in signature sets that include the “Server Side Code Injection” attack type or “PHP” System.


Figure 1Exploit blocked with attack signature 200004268


Figure 2Exploit blocked with attack signature 200004188

Additional Reading


Version history
Last update:
‎24-Feb-2019 04:00
Updated by: