10-Dec-2021 17:55
11-Dec-2021
00:59
- last edited on
06-Jun-2023
14:24
by
LiefZimmerman
Hi @Daniel Martinez,
the following iRule will check the headers and the payload of any POST request for the stringand reject them.
This iRule is provided "as is", without a warranty that it is a guaranteed protection against this CVE or any kind of performance testing.
Patching your servers, or using AWAF or Threat Campaigns is the better alternative.
Currently, in my opinion, the best read on this vulnerability is: https://isc.sans.edu/forums/diary/RCE+in+log4j+Log4Shell+or+how+things+can+get+bad+quickly/28120/
AWAF, TC and NGINX App Protect signatures are available: https://support.f5.com/csp/article/K19026212
KR
Daniel
11-Dec-2021 07:11
In case someone is interested, here is my Postman Collection which I used for testing:
https://raw.githubusercontent.com/webserverdude/f5-general/main/iRules/CVE-2021-44228.postman_collection.json
In the same repo there's the current version of the iRule > rule_mitigate_CVE-2021-44228.irul
11-Dec-2021
10:17
- last edited on
05-Jun-2023
21:07
by
JRahm
Last update from my side. F5 has provided iRules to mitigate CVE-2021-44228 here: https://support.f5.com/csp/article/K19026212
Due to a more strict regex the F5 iRule will also protect you against the recently observed more obfuscated variants such as:
I'm done.
13-Dec-2021 23:22
Hi @danielm,
usually I am not asking for this, but the Log4shell issue is kind of important.
Could you please mark this question as "Answered"? Under each answer there is "Select As Best", which is equivalent to "Answered". Just select my above answer as best. This way other community members can find the iRule mitigation for CVE-2021-44228 faster and easier.
Thanks in advance & KR
Daniel
11-Dec-2021 04:53
You may want to consider scanning the entire HTTP request as one variable. [HTTP::request],
You may also want to normalize it using [URI::decode [HTTP::request]] , or [URI::decode [HTTP::payload]] , this way, attacks including "jndi%3Aldap" do not succeed.
HTH
11-Dec-2021
05:30
- last edited on
06-Jun-2023
14:14
by
LiefZimmerman
I just did quick and dirty
Not sure about the overhead on the iRule at the top
13-Dec-2021 12:05
Check the AskF5 solution linked here in the DevCentral Connects show article for latest updates on recommended iRule for this.
13-Dec-2021 15:28
I tried implementing the iRule linked from the AskF5 solution article, but as written it causes my site(s) to throw an HTTP 400 "Bad Request" error.
Anyone else see that behavior? Ideas?
13-Dec-2021
23:17
- last edited on
24-Mar-2022
01:21
by
li-migration
Hi ,
this should not be the case. Unless the iRule matches the pattern of the attack, it does not alter the request going to the backend servers.
Can you compare the requests sent to the backend servers with and without the iRule? Using tools like tcpdump, wireshark or just from the log of the backend servers? Can you spot any differences in the HTTP Requests?
KR
Daniel