NimbostratusDoes anyone know if ASM provides, or can provide, mitigation for this DOS vulnerability in Apache Struts?
https://threatpost.com/apache-warns-of-faulty-zero-day-patch-for-struts/105691
thanks!
Cirrocumulusbdy,
I don't know the specifics of this vulnerability but it looks like parameter tampering. If so the ASM can indeed protect on this. You can define Parameters and then, for example, configure what values are allowed, e.g. integers, digits, alphanumeric etc, or allow/disallow specific meta-characters.
This should help mitigate this vulnerability I hope.
N
NimbostratusNir Zigler has a good write up here: https://devcentral.f5.com/articles/apache-struts-classloader-manipulation-vulnerabilities