Forum Discussion

AndréB's avatar
AndréB
Icon for Nimbostratus rankNimbostratus
Jul 29, 2021

ASM / WAF : block request containing certain string?

I have added as much XSS blocking to a policy as possible. A request containing onmouseover or onclick or .... ="alert('hello')" is blocked fine.

But when it's coded like onmouseover or onclick or .... ="self['\x....... the ASM accepts this as valid.

Can I block a request with this parameter value?

How do I achieve this?

 

2 Replies

  • Sajid's avatar
    Sajid
    Icon for Cirrostratus rankCirrostratus

    try custom attack signature

    Security ›› Options: Application Security: Attack Signatures: Attack Signatures List

     

    Click create and define your own pattern.

     

  • Hi Sajid,

    Your suggestion creates a "global" attack signature. And will, on creation, as I read it, be added to all the policies.

    We have several policies running and I don't want to mess up policies for which I'm not responsible.

    There is an attack signature self[] (parameter) (id 200101630) to choose from and is already added/active to the policy.

    But it doesn't block self['\x... ], self with HEX in it as it is added in the value part of a parameter.

    Maybe it's better to report it to F5 Support