Forum Discussion

schusb's avatar
schusb
Icon for Nimbostratus rankNimbostratus
Jun 13, 2018

How to block exe-File - uploads with extension unlike exe

It seems that ASM allows the upload of executables whose extension was changed from .exe to something different. If the extension is .exe, the request gets blocked as expected.

 

Configuration: The the parameter was explicit declared as FileUplod - Type with the option enabled 'Disallow File Upload of Executables'. Furthermore the corresponding Learning and Blocking Setting: 'Disallowed file upload content detected' was also set to Learn / Alarm / Block.

 

ASM Advanced WAF
disallow file upload of executables
disallowed file upload content
file upload
security

1 Reply

Sort By
  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Jun 13, 2018

    ASM doesn't detect file type upload. it can only detect extension.

     

    If you want content analysis, you can configure ASM (or LTM) to forward HTTP requests to an ICAP server (all antivirus vendors provide such solution as an add-on license).