Forum Discussion

Ken_49643's avatar
Ken_49643
Icon for Nimbostratus rankNimbostratus
Jul 10, 2011

XML Attack Signatures

Hi,

 

 

I am new to this forum and am hoping to get some assistance on XML attack signatures.

 

 

We have a standard HTTP POST request that contains an XML message in the body.

 

The content type is set as application/xml; charset="utf-8".

 

 

The attack signature "xml tag (Parameter)" is being triggered on the following XML prolog:

 

 

xml version="1.0" encoding="UTF-8" (The opening/closing angle brackets and question mark are omitted)

 

 

This looks like pretty standard XML to me. Anyone help with why this is being triggered?

 

Do I need to specify an XML profile for the URL?

 

 

Any help would be greatly appreciated.

 

 

Ken

 

APM
app sec
security

2 Replies

Sort By
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Jul 10, 2011
    Hi Ken,

     

     

    That attack signature matched any XML tag. You could either disable that signature or create a custom XML profile and add it for the URI filtering on a content-type of *xml*.

     

     

    Aaron
  • Ken_49643's avatar
    Ken_49643
    Icon for Nimbostratus rankNimbostratus
    Jul 13, 2011
    Thanks Aaron.

     

     

    I had assumed that since the content type was specified as application/xml the attack signatures wouldn't match on valid XML.

     

     

    Ken