Bug ID 862793: ASM replies with JS-Challenge instead of blocking page upon "Virus detected" violation

Last Modified: Sep 13, 2023

Affected Product(s):
BIG-IP ASM(all modules)

Known Affected Versions:
15.0.0, 15.0.1,,,,, 15.1.0,,,,,, 15.1.1, 15.1.2,, 15.1.3,

Fixed In:
16.0.0, 15.1.4

Opened: Dec 17, 2019

Severity: 3-Major


When ASM detects "virus" (with help of external icap server), the response page will be JS-Challenge instead of blocking.


-- End user client gets JS-Challenge response instead of blocking page. -- End user does not see ASM support ID. -- Browser can run the JavaScript and resend the request to ASM, which is then forwarded to the backend server.


-- ASM provisioned. -- ASM policy attached to a virtual server. -- Anti-Virus protection enabled in ASM policy. -- ASM finds a virus in a request.



Fix Information

The software now replies with the blocking page, including the ASM support ID.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips