cancel
Showing results for 
Search instead for 
Did you mean: 

Header Based content profile

THE_BLUE
Cirrus
Cirrus

If i have form with

Content-Type: multipart/form-data; boundary ................

that require file upload , when any file attached it is give attack signature detect. i have tried to add some change under specific url ex:

application security > url > advanced > Header Based content profile >

Request header Name :Content-Type

Request Header Value : *multipart/form-data*

Request Body Handling : Do nothing

 

so now is there any risk on doing this ? meaning that if there is a real attack it will be blocked or not?

and how f5 intercept the attach file?

7 REPLIES 7

Lidev
MVP
MVP

Hello Blue,

 

Yes there's a risk, it's not recommended not to check the body on request with multipart .

Did you try to set the parameter called during this request in Data type : File upload as in the screenshot below ?

0691T000009iGyvQAE.png

Regards

Hello Lidev,

Yes I did , but the issue still there.

Does ASM inspect the file (pdf,jpg and so on ) ? or what exactly ?

Lidev
MVP
MVP

Hi BLUE,

 

Yes, ASM does carries out certain checks on file upload : https://support.f5.com/csp/article/K01235989

Can you specify which signature attack is raised and its details ?

 

Regards

 example :

"arp" execution attempt , but no detalis in payload related to files type.

but sometimes i can see in payload pdf , jpg and so on. something like encoding.

 

is there any change i have to apply under attack signature in learning and blocking settings?

how can i understand where ASM detect the attack ?

because sometimes i can not understand (only letters and characters ).

 

do i have to enable attack signature in policy based on server technologies or what ?

 

appreciate your help.

 

 

Lidev
MVP
MVP

If the violation raised by ASM is "arp execution" it's because ASM has revealed during the analysis of the request certain elements which make it think of a command execution attack.

If you think it's a false positive, you can disable the signature attack on the item (url/parameter) that raised the violation.

 

You cannot see in detail what analysis and performed by the ASM on signature attacks, these elements are protected so that we cannot bypass this security part.

 

Adding the server technologies used by your servers in the ASM policy can indeed at first glance limit false positives

so since "arp execution" is related to linux , and in server technologies linux not there , so i can remove linux attack signture from this policy right?

Lidev
MVP
MVP

If your backend servers don't use a Linux system, yes it's a good start to not overload the ASM with unnecessary signature attacks.