Last Modified: Apr 28, 2025
Affected Product(s):
BIG-IP ASM
Known Affected Versions:
15.1.0, 15.1.0.1, 15.1.0.2, 15.1.0.3, 15.1.0.4, 15.1.0.5, 15.1.1, 15.1.2, 15.1.2.1, 15.1.3, 15.1.3.1, 15.1.4, 15.1.4.1, 15.1.5, 15.1.5.1, 15.1.6, 15.1.6.1, 15.1.7, 15.1.8, 15.1.8.1, 15.1.8.2, 15.1.9, 15.1.9.1, 15.1.10, 15.1.10.2, 15.1.10.3, 15.1.10.4, 15.1.10.5, 15.1.10.6, 16.1.0, 16.1.1, 16.1.2, 16.1.2.1, 16.1.2.2, 16.1.3, 16.1.3.1, 16.1.3.2, 16.1.3.3, 16.1.3.4, 16.1.3.5, 16.1.4, 16.1.4.1, 16.1.4.2, 16.1.4.3, 17.1.0, 17.1.0.1, 17.1.0.2, 17.1.0.3
Fixed In:
17.5.0, 17.1.1, 16.1.5
Opened: Apr 02, 2023 Severity: 3-Major
In certain configurations, an HTTP request containing an HTTPS origin header may be blocked due to an 'Illegal cross-origin request' violation.
An 'Illegal cross-origin request' violation is reported in version 17.1.x, unlike in version 16.1.x, with the same configurations and traffic.
A request sent to a virtual server on an HTTP port (or any port other than 443) with an origin header set to HTTPS will trigger a violation under the following conditions: 1. The 'Illegal cross-origin request' violation is enabled. 2. In Security > Application Security > Security Policies > Policies List, click Create. Add a policy name (for example, Auto_Security_Policy_Services) and click Save. Then, on the Policies List page, click the created policy name and go to HTTP Message Protection > Headers > Host Names. This issue occurs when the host name is configured with the origin header value specified in this path. 3. The URL where the request is sent has 'Enforce on ASM' enabled in the 'HTML5 Cross-Domain Request' configuration area.
Add the HTTPS protocol and origin name to the required URL in the 'Allowed Origins' setting, located under 'HTML5 Cross-Domain Request'.
With the internal parameter enabled, an 'Illegal cross-origin request' violation will not be reported. By default, the internal parameter is disabled. However, it can be enabled using the following commands: /usr/share/ts/bin/add_del_internal add cors_match_protocol_port 1 /usr/share/ts/bin/add_del_internal add cors_default_port_80 1 tmsh restart sys service asm This enables the parameter and restarts the ASM service to apply the changes.