Bug ID 862793: ASM replies with JS-Challenge instead of blocking page upon "Virus detected" violation

Last Modified: Jul 07, 2020

Bug Tracker

Affected Product:  See more info
BIG-IP ASM(all modules)

Known Affected Versions:
15.0.0, 15.0.1, 15.0.1.1, 15.0.1.2, 15.0.1.3, 15.1.0, 15.1.0.1, 15.1.0.2, 15.1.0.3, 15.1.0.4

Opened: Dec 17, 2019
Severity: 3-Major

Symptoms

When ASM detects "virus" (with help of external icap server), the response page will be JS-Challenge instead of blocking.

Impact

-- End user client gets JS-Challenge response instead of blocking page. -- End user does not see ASM support ID. -- Browser can run the JavaScript and resend the request to ASM, which is then forwarded to the backend server.

Conditions

-- ASM provisioned. -- ASM policy attached to a virtual server. -- Anti-Virus protection enabled in ASM policy. -- ASM finds a virus in a request.

Workaround

None.

Fix Information

None

Behavior Change