F5 Rules for AWS WAF
82 TopicsF5 Rules for AWS WAF CVE-2021-40438
Hello, We're checking in the AWS marketplace for theF5 Rules for AWS WAF - Common Vulnerabilities and Exposures (CVE) Rulesand want to check ifCVE-2021-40438 is covered by this rule set? https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40438323Views1like4CommentsF5 Rules for AWS WAF - Rule ID to Attack Type Reference
F5 offers security solutions for AWS customers who use the platform's hosting and load balancing services along with the AWS WAF offering. F5 Rules for AWS WAF - Web exploits OWASP RulesF5 Rules for AWS WAF - Bot Protection RulesF5 Rules for AWS WAF - Common Vulnerabilities and Exposures (CVE)F5 Rules for AWS WAF - API Security Rules With the recent addition of logging capabilities of requests that had a match with one of the rule sets, there is now an option to: See the full request that had a match with the rule ID. Understand the attack type that relates to the rule ID. Remove specific rule ID from the rule set in the case it generates false positives. The following CSV maps between rule IDs and attack types, and will help customers of the F5 Rules for AWS WAF products to better manage rule exclusions in their Access Lists. For more details on AWS-WAF logging configuration please visit:https://docs.aws.amazon.com/waf/latest/developerguide/logging.html2.3KViews1like9CommentsHow much does it cost to apply "F5 Rules for AWS WAF - Common Vulnerabilities & Exposures (CVE) Rules" to Cloudfront?
Hello How much does it cost to apply "F5 Rules for AWS WAF - Common Vulnerabilities & Exposures (CVE) Rules" to Cloudfront? The product page describes it as follows https://aws.amazon.com/marketplace/pp/prodview-y4tlpqpjpm4qi Monthly fee for each applicable region (pro-rated per hour) $20 / unit I understand that there is a fee for each region when applied to ALB, but what about Cloudfront? Will I be charged for all regions?372Views1like1CommentAWS WAF - Web Exploits Rules by F5 - Log4J Update
Hi F5 Does the ruleset "AWS WAF - Web Exploits Rules by F5" now offer any protection from requests seeking to exploit the Log4J vulnerability described in CVE-2021-44228 If not currently - can you advise when we may expect an update? Thank you486Views1like2CommentsAWS F5 Managed WAF rules not blocking simple SQL injection
We have subscribed to the "F5 Rules for AWS WAF - API Security Rules". Product page: https://aws.amazon.com/marketplace/pp/B07M948X2H. A Web ACL has been created in our AWS account using this group of rules. It has been then associated to an API published on the Amazon API Gateway. For some reason, even basic SQL injection are not blocked. For instance, a request with a url-encoded string like ' OR '1'='1 (see https://en.wikipedia.org/wiki/SQL_injection) in querystring is not blocked. Switching to a group of rules managed by a competitor (Fortinet) resolved our problem. We are surprised the F5 rules are so permissive. Maybe we are missing something. Any thoughts ? Thank you. Related question: https://devcentral.f5.com/s/feed/0D51T00006i7iONSAY1KViews1like15Comments