Forum Discussion

Subrun's avatar
Subrun
Icon for Cirrostratus rankCirrostratus
Nov 07, 2019

Legitimate Traffic is Blocked at ASM Policy

Certain good traffic is blocked at ASM Policy. From the event Log i see as HTTP protocol compliance failed , due to HTTP Validation tagged with " Null in request" .

 

HTTP POST shows %00 ( Bold Below ) about which it is mentioned here in this KB https://support.f5.com/csp/article/K7931.

 

f=json&checksum=%EF%BF%BD%1D%EF%BF%BD%D9%8F%00%EF%BF%BD%04%EF%BF%BD%09%EF%BF%BD%EF%BF%BD%EF%BF%BDB%7E&parts=1

 

In K7931 it shows 3 ways how to prevent this but can some one help out of 3 ways which one I should use and why to prevent this Null in Request message ?

 

Attached Event Log message.

 

 

application delivery
ASM Advanced WAF
BIG-IP
Null in Action
security

9 Replies

Sort By
  • gersbah's avatar
    gersbah
    Icon for Cirrostratus rankCirrostratus
    Nov 08, 2019

    Why: https://www.owasp.org/index.php/Embedding_Null_Code

     

    How: Unless this is a very common occurence in your application in many different places, I would limit the exception to where it's actually needed. So that would be option 1 from the KB you linked. Create the parameter "checksum" and set it to type "File Upload".

    • Subrun's avatar
      Subrun
      Icon for Cirrostratus rankCirrostratus
      Nov 08, 2019

      Appreciate your help..

       

      I am just trying to understand how we will prevent null in request Blocking while setting parameter "checksum" and set it to type "File Upload". I mean i am looking for a more technical explanation for this.

       

      Also another concern is by doing this ( with option 1 ) is that a risk I am accepting for SQL Injection type of attack ?

  • gersbah's avatar
    gersbah
    Icon for Cirrostratus rankCirrostratus
    Nov 08, 2019

    Setting the parameter type "File Upload" limits the range of checks that are performed on the parameter value. The primary usage is obviously file uploads, because for example a PDF file or Excel sheet is pretty much a binary blob with some text sprinkled in between and applying meta character checks to see if it includes a quote, a dollar sign, a null byte or some nonprintable character somewhere doesn't make a lot of sense.

     

    In version 14 (maybe also 13?) you can select to still check attack signatures on File Upload parameters - which for real file uploads may not be very useful, but for your scenario should be a good idea. (note: never tested if this actually works)

     

     

    Setting the checksum parameter to file upload will open you up to some risk of attacks specifically on that parameter, because checks on the parameter will be limited.

    If you find this more concerning than globally allowing null bytes, then disabling the "null in request" violation would be the way to go.

     

     

    There may be another option that is not mentioned in the KB: An iRule to selectively unblock the request if this violation occurs specifically on that parameter. But that would require some engineering and I don't know if it even actually works.

    • Subrun's avatar
      Subrun
      Icon for Cirrostratus rankCirrostratus
      Nov 08, 2019

      I see that for "File Upload" Option there is no Attack Signature Option I can select. Images attached.

       

       

      • gersbah's avatar
        gersbah
        Icon for Cirrostratus rankCirrostratus
        Nov 08, 2019

        This is a feature of version 14 and later. See https://support.f5.com/csp/article/K79544554

        "Note: Prior to BIG-IP ASM 14.0.0, you can configure attack signatures for parameters of Alpha-Numeric data type. Starting in BIG-IP ASM 14.0.0, you can configure attack signatures for parameters of File Upload data type, in addition to parameters of Alpha-Numeric data type."

    • Subrun's avatar
      Subrun
      Icon for Cirrostratus rankCirrostratus
      Nov 08, 2019

      Can you explain little bit more on this

       

      "If you find this more concerning than globally allowing null bytes, then disabling the "null in request" violation would be the way to go."

       

      • gersbah's avatar
        gersbah
        Icon for Cirrostratus rankCirrostratus
        Nov 08, 2019

        I can't give you a clear right or wrong answer on this.

         

        When you disable the "null in request" violation, it will be disabled for the entire policy. If your application is vulnerable to null byte attacks anywhere, then you lost a relevant protection for that. Likely not the only protection, as one of the other violations may be able to catch it. So is this an acceptable risk? Probably yes, but I can't make that call without knowing your application and your security requirements or general policy setup.

         

        If you set the parameter to type File Upload, this will only affect this specific parameter and not the rest of your policy. But if your application happens to be vulnerable to any kind of injection attack exactly on that parameter, then ASM would likely not be able to prevent it anymore (unless you run v14 and have attack signatures enabled on the parameter). Again, if this is likely, or if the risk is acceptable, is something you alone can decide.