ASM / WAF : block request containing certain string?

[AndréB]

I have added as much XSS blocking to a policy as possible. A request containing onmouseover or onclick or .... ="alert('hello')" is blocked fine.

But when it's coded like onmouseover or onclick or .... ="self['\x....... the ASM accepts this as valid.

Can I block a request with this parameter value?

How do I achieve this?

[Sajid]

try custom attack signature

Security ›› Options: Application Security: Attack Signatures: Attack Signatures List

Click create and define your own pattern.

[AndréB]

Hi Sajid,

Your suggestion creates a "global" attack signature. And will, on creation, as I read it, be added to all the policies.

We have several policies running and I don't want to mess up policies for which I'm not responsible.

There is an attack signature self[] (parameter) (id 200101630) to choose from and is already added/active to the policy.

But it doesn't block self['\x... ], self with HEX in it as it is added in the value part of a parameter.

Maybe it's better to report it to F5 Support