Header Based content profile

[THE_BLUE]

If i have form with

Content-Type: multipart/form-data; boundary ................

that require file upload , when any file attached it is give attack signature detect. i have tried to add some change under specific url ex:

application security > url > advanced > Header Based content profile >

Request header Name :Content-Type

Request Header Value : *multipart/form-data*

Request Body Handling : Do nothing

so now is there any risk on doing this ? meaning that if there is a real attack it will be blocked or not?

and how f5 intercept the attach file?

[Lidev]

Hello Blue,

Yes there's a risk, it's not recommended not to check the body on request with multipart .

Did you try to set the parameter called during this request in Data type : File upload as in the screenshot below ?

Regards

[THE_BLUE]

Hello Lidev,

Yes I did , but the issue still there.

Does ASM inspect the file (pdf,jpg and so on ) ? or what exactly ?

[Lidev]

Hi BLUE,

Yes, ASM does carries out certain checks on file upload : https://support.f5.com/csp/article/K01235989

Can you specify which signature attack is raised and its details ?

Regards

[THE_BLUE]

 example :

"arp" execution attempt , but no detalis in payload related to files type.

but sometimes i can see in payload pdf , jpg and so on. something like encoding.

is there any change i have to apply under attack signature in learning and blocking settings?

how can i understand where ASM detect the attack ?

because sometimes i can not understand (only letters and characters ).

do i have to enable attack signature in policy based on server technologies or what ?

appreciate your help.

[Lidev]

If the violation raised by ASM is "arp execution" it's because ASM has revealed during the analysis of the request certain elements which make it think of a command execution attack.

If you think it's a false positive, you can disable the signature attack on the item (url/parameter) that raised the violation.

You cannot see in detail what analysis and performed by the ASM on signature attacks, these elements are protected so that we cannot bypass this security part.

Adding the server technologies used by your servers in the ASM policy can indeed at first glance limit false positives

[THE_BLUE]

so since "arp execution" is related to linux , and in server technologies linux not there , so i can remove linux attack signture from this policy right?

[Lidev]

If your backend servers don't use a Linux system, yes it's a good start to not overload the ASM with unnecessary signature attacks.