Bug ID 862793: ASM replies with JS-Challenge instead of blocking page upon "Virus detected" violation

Last Modified: Jul 07, 2020

Bug Tracker

Affected Product:  See more info
BIG-IP ASM(all modules)

Known Affected Versions:
15.0.0, 15.0.1,,,, 15.1.0,,,,

Opened: Dec 17, 2019
Severity: 3-Major


When ASM detects "virus" (with help of external icap server), the response page will be JS-Challenge instead of blocking.


-- End user client gets JS-Challenge response instead of blocking page. -- End user does not see ASM support ID. -- Browser can run the JavaScript and resend the request to ASM, which is then forwarded to the backend server.


-- ASM provisioned. -- ASM policy attached to a virtual server. -- Anti-Virus protection enabled in ASM policy. -- ASM finds a virus in a request.



Fix Information


Behavior Change