cancel
Showing results for 
Search instead for 
Did you mean: 

Can't upload msg file - ASM block

THE_BLUE
Cirrus
Cirrus

WAF block my request due to " attack signature detected" when try to upload msg file , and the Context : HTTP Request Body Unparsed Payload.

the request is look like this :

Content-Type: multipart/form-data;

Content-Disposition: form-data; name="sth.msg" fileName="sth.msg"

the name of parameter take the same name of file upload with each request, so how can we solve this?

1 ACCEPTED SOLUTION

This looks correct, though I don't have any lab where I could test this at the moment.

Your configuration would apply anytime the Content-Type header value is multipart/form-data.

The Request Header Value allows wildcards. You could try to narrow down to Do Nothing only for .msg files by testing this combination:

 

Request Header Name : Content-Disposition

Request Header Value : form-data; name="*.msg"; filename="*.msg"

Request Body Handling : Do Nothing

 

EDIT: A word of caution. You should consider to what risk you are exposing your application when not checking these uploads.

View solution in original post

6 REPLIES 6

Hi , 

 

I guess this discribes your blocking message and a possibe solution:

K32081491: ASM blocked a request due to Attack Signatures triggered with Violation Context AMF body

 

KR

Daniel

 

Dear Daniel,

Many thanks for sharing.

For Request Header Name, enter an explicit header name that must appear in requests for this URL.

 

so in my case i have to do like this :

Request Header Name : Content-Type

Request Header Value : multipart/form-data;

Request Body Handling : Do Nothing

This looks correct, though I don't have any lab where I could test this at the moment.

Your configuration would apply anytime the Content-Type header value is multipart/form-data.

The Request Header Value allows wildcards. You could try to narrow down to Do Nothing only for .msg files by testing this combination:

 

Request Header Name : Content-Disposition

Request Header Value : form-data; name="*.msg"; filename="*.msg"

Request Body Handling : Do Nothing

 

EDIT: A word of caution. You should consider to what risk you are exposing your application when not checking these uploads.

Many thanks, i will test that.

Thanks for the note, sure I will.

THE_BLUE
Cirrus
Cirrus

I have test that but still the same issue is still exist.

As said, I don't have a lab that I could use to test your particular case.

Did you try with this combination too?

 

Request Header Name : Content-Type

Request Header Value : multipart/form-data;

Request Body Handling : Do Nothing

 

Maybe the Request Header Value is just not matching with the wildcards?