If i have form with
Content-Type: multipart/form-data; boundary ................
that require file upload , when any file attached it is give attack signature detect. i have tried to add some change under specific url ex:
application security > url > advanced > Header Based content profile >
Request header Name :Content-Type
Request Header Value : *multipart/form-data*
Request Body Handling : Do nothing
so now is there any risk on doing this ? meaning that if there is a real attack it will be blocked or not?
and how f5 intercept the attach file?
Yes there's a risk, it's not recommended not to check the body on request with multipart .
Did you try to set the parameter called during this request in Data type : File upload as in the screenshot below ?
"arp" execution attempt , but no detalis in payload related to files type.
but sometimes i can see in payload pdf , jpg and so on. something like encoding.
is there any change i have to apply under attack signature in learning and blocking settings?
how can i understand where ASM detect the attack ?
because sometimes i can not understand (only letters and characters ).
do i have to enable attack signature in policy based on server technologies or what ?
appreciate your help.
If the violation raised by ASM is "arp execution" it's because ASM has revealed during the analysis of the request certain elements which make it think of a command execution attack.
If you think it's a false positive, you can disable the signature attack on the item (url/parameter) that raised the violation.
You cannot see in detail what analysis and performed by the ASM on signature attacks, these elements are protected so that we cannot bypass this security part.
Adding the server technologies used by your servers in the ASM policy can indeed at first glance limit false positives