Forum Discussion

Robert_Shortley's avatar
Robert_Shortley
Icon for Nimbostratus rankNimbostratus
Aug 13, 2015

ASM Reading PDF Content as Attack from Multipart/Form-data Web Form Upload

I have one site that I'm trying ASM on, and uploading a PDF from a FILE input in a multipart/form-data web form is triggering a SQL Injection blockage from the ASM.

 

The ASM seems to be choking on the binary stream of the contents of the file.

 

Is there a way to keep this from happening enterprise wide, with a mixture of COTS products and custom code, for multiple web sites & applications?

 

Request Status: Blocked, Truncated Severity: Error Violation Rating: 2 - Request looks like a false positive but requires examination Response Status Code: N/A Attack Types: Detection Evasion, Server Side Code Injection, SQL-Injection

 

ASM Advanced WAF
security

6 Replies

Sort By
  • Robert_Shortley's avatar
    Robert_Shortley
    Icon for Nimbostratus rankNimbostratus
    Aug 13, 2015
    I did see this thread: https://devcentral.f5.com/s/feed/0D51T00006i7bGdSAI But I need a solution that's going to work over a whole enterprise with many different field names.
  • Robert_Shortley's avatar
    Robert_Shortley
    Icon for Nimbostratus rankNimbostratus
    Aug 13, 2015
    Detected Keyword: &p![B5lB'&1m=ITh\LtiNEn!s2;\0:]C;7?naZ> JpY4^:iR,19>aO.,Ud!?"Q/7'f7_T'S?SabW0;4bo6W9*`f&.*(]p;%ogjQ,i!TnR`A[i3[F 'EX>V4W/&rL%
  • Robert_Shortley's avatar
    Robert_Shortley
    Icon for Nimbostratus rankNimbostratus
    Aug 13, 2015
    Content-Disposition: form-data; name="gfe_lib_file"; filename="C:\Users\xxxxxxxxxx\Desktop\xxxxxxxxxx.pdf" Content-Type: application/pdf %PDF-1.4 1 0 obj << /Creator (Oracle10gR2 AS Reports Services) /CreationDate (D:20150807110634) /ModDate (D:20150807110634) /Producer (Oracle PDF driver) /Title (o32815067.out) /Author (Oracle Reports) >> endobj 5 0 obj <> stream Gat=.=``=g%Y"/U5g=-4HE(eY04&oB7:I6RCe9cQGeBNJ/OjKqbil9&.MMjZ"hL2Q7E_jY<9uGu 7K[6cJYQ%&4_=DJEocWl0'/mX1&X/OVc'do-7VZqs5[n<5Lk$.Q@rL bhA+\AGQ-TPe-XP:UO8)=g]l3^RMG,eD>;T0RHd_K`]PRnq+r!]",LJi3Mrl3:UFsm8\g%N&p![B5lB'&1m=ITh\LtiNEn!s2;\0:]C;7?naZ> JpY4^:iR,19>aO.,Ud!?"Q/7'f7_T'S?SabW0;4bo6W9*`f&.*(]p;%ogjQ,i!TnR`A[i3[F ...etc
  • Robert_Shortley's avatar
    Robert_Shortley
    Icon for Nimbostratus rankNimbostratus
    Aug 17, 2015
    Is there a way to keep the ASM from reading the contents of files that are being uploaded? Signature ID 200002305 seems like it is going to be a rather obnoxious problem.
  • gsharri's avatar
    gsharri
    Icon for Altostratus rankAltostratus
    Aug 17, 2015

    You can modify the properties of the parameter that is used for file uploads:

     

    Parameter value type: User input value

     

    Data type: file upload

     

    With those settings ASM will no longer apply attack signatures to the data contained in that parameter. There is no single setting for ASM or the security policy that will stop the examination of file uploads.