For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Julie's avatar
Julie
Icon for Altostratus rankAltostratus
Aug 20, 2020

ASM security policy with Atlassian Confluence

Has anybody configured an Atlassian Confluence server behind an F5 with ASM security? I find that it's getting LOTS of false positives that I'm hesitant to accept, mostly of the SQL injection variet...
ASM Advanced WAF
Atlassian
BIG-IP
confluence
security
Julie's avatar
Julie
Icon for Altostratus rankAltostratus
Aug 24, 2020

I've made sure that the JSON profile is is first in line, but looking more closely at this, I'm seeing that the problematic POST requests are coming in as

 

Content-Type: text/plain

 

with

 

Accept: application/json, text/javascript, */*; q=0.01

 

I'm assuming this explains why it's not parsing properly? Or should it be recognizing the content as JSON automatically?

Ivan_Chernenkii's avatar
Ivan_Chernenkii
Icon for Employee rankEmployee
Aug 24, 2020

Hello Julie,

 

Could you provide example of failed requests and configuration of "Header-Based Content Profiles" of URL in policy, which this request matches?

 

Thanks, Ivan