Bug ID 701792: JS Injection into cached HTML response causes TCP RST on the fictive URLs

Last Modified: Sep 13, 2023

Affected Product(s):
BIG-IP ASM(all modules)

Known Affected Versions:
12.0.0, 12.0.0 HF1, 12.1.0 HF1, 12.0.0 HF2, 12.1.0 HF2, 12.0.0 HF3, 12.0.0 HF4, 12.1.1 HF1, 12.1.1 HF2, 12.1.2 HF1, 12.1.2 HF2, 12.1.0, 12.1.1, 12.1.2, 12.1.3,,,,,,,, 12.1.4,, 12.1.5,,,, 12.1.6, 13.0.0, 13.0.0 HF1, 13.0.0 HF2, 13.0.0 HF3, 13.0.1, 13.1.0,,,,,,,,, 13.1.1,,

Fixed In:

Opened: Jan 13, 2018

Severity: 3-Major


TCP RST being sent when a browser requests a fictive URL that starts with either of the following strings: -- /TSPD/xxx...xxx?type=x -- /TSbd/xxx...xxx?type=x.


CSRF/Web Scraping/Single Page Application/AJAX Blocking page features might not work. This happens intermittently when the back-end server's HTML page (the one where the fictive URL is injected) is cached in the browser for more than two days.


This occurs in either of the following scenarios: -- ASM policy is attached to a virtual server, and any of the following is enabled: Cross-Site Request Forgery (CSRF), Web Scraping/Single Page Application/AJAX Blocking internal. -- DoS profile with Single Page Application enabled is attached to a virtual server.


Use an iRule to disable caching for HTML pages where a fictive URL is injected.

Fix Information

The system now includes a new ASM Internal Parameter 'disable_cache_upon_injection', disabled by default. When it is enabled, ASM disables cached headers to HTML responses where a fictive URL is injected.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips