Forum Discussion

svs's avatar
svs
Icon for Cirrus rankCirrus
Sep 28, 2016

ASM Violation "HTTP Header Injection"

Hi Folks,

 

in the last days I saw the violation "HTTP Header Injection" very often in my manual traffic learning. When looking at the request I can't really understand, what causes this violation. Typically it's related to "0xa" within the request body. In fact this means just a newline. I know, that this can be used in form fields to inject protocol header (i.e. in SMTP), but in my case this is just HTTP and was a newline within the request. It appeared several times in the request, but only one was causing this violation.

 

Typically I would clear this violation and wait until it returns a second time, but I can't because this will block legal request. So today I can only see false positives for this kind of signatures.

 

I would like to share an example request with you, but for if I would strip the sensitive content, you wouldn't see the interesting parts. So for now I will try to get experiences from you related to this violation and maybe some more information about it and how to handle this violation (without just disable all the signatures).

 

Hopefully this is clear.

 

Thanks in advance.

 

Greets, svs

 

ASM Advanced WAF
security

2 Replies

Sort By
  • Tikka_Nagi_1315's avatar
    Tikka_Nagi_1315
    Historic F5 Account
    Sep 29, 2016

    Without seeing the actual HTTP Request it's difficult to answer this question. You could open a support case and provide the details.

     

    The violation 'HTTP Header Injection' is triggered by Signature ID 200018023. You can disable the signature 200018023 and customize a new signature to allow “0xa” and “0xd”. Please refer to the manual chapter: https://support.f5.com/kb/en-us/products/big-ip_asm/manuals/product/asm-config-11-3-0/asm_attack_sigs.html?sr=474886781031942

     

  • svs's avatar
    svs
    Icon for Cirrus rankCirrus
    Oct 14, 2016

    I've tried to remove sensitive data from the full request, to post it, but the relevant part of the request contains the sensitive data. So removing or replacing it, wont help to find the cause for it.

     

    I saw this HTTP Header Injection suddenly on every single installation I've done. I thought of an issue with the signature database, but currently there is no update. I will do as you have suggested and open a support case for this.

     

    Thanks for your help.

     

    Greets, svs