Hi F5 community,I'm using these F5 rules for AWS WAF with API Gateway and Application Load Balancer resources.F5 Rules for AWS WAF - Common Vulnerabilities and Exposures (CVE)F5 Rules for AWS WAF - API Security RulesHow do I know these vulnerabilities are no impact on AWS WAF? or Has it been fixed in the F5 rules? orDo I need to create a custom F5 rules to protect these vulnerabilites?Regards,Worapoj

All the Support info is here: https://community.f5.com/t5/technical-forum/k24912123-mitigate-the-spring-framework-spring4shell-and-spring/td-p/294047 And, there was a Signiture Update Yesterday - Select Product and Path at https://downloads.f5.com/esd/productlines.jsp

Forum Discussion

worapojc

Altostratus

Apr 01, 2022

Does Spring4Shell impacts on F5 AWS WAF?

Hi F5 community,

I'm using these F5 rules for AWS WAF with API Gateway and Application Load Balancer resources.

How do I know these vulnerabilities are no impact on AWS WAF? or
Has it been fixed in the F5 rules? or
Do I need to create a custom F5 rules to protect these vulnerabilites?

Regards,
Worapoj

cloud

F5 Rules for AWS WAF

security

PSilva
Apr 01, 2022
All the Support info is here: https://community.f5.com/t5/technical-forum/k24912123-mitigate-the-spring-framework-spring4shell-and-spring/td-p/294047

And, there was a Signiture Update Yesterday - Select Product and Path at https://downloads.f5.com/esd/productlines.jsp

PSilva
Ret. Employee
Apr 01, 2022
See this:

K24912123: Mitigate the Spring Framework (Spring4Shell) and Spring Cloud vulnerabilities with the BIG-IP system - https://support.f5.com/csp/article/K24912123
worapojc
Altostratus
Apr 01, 2022
Hi,
I'm not sure I understand it correctly but it seems for F5 appliance or others which is not SaaS, on AWS.
So, I would like to know the vulnerabilties are no impact on the F5 AWS WAF rules and F5 has updated signatures to protect this issue.

Could you please provide more details for AWS WAF specific areas?

Regards
- PSilva
  Ret. Employee
  Apr 01, 2022
  All the Support info is here: https://community.f5.com/t5/technical-forum/k24912123-mitigate-the-spring-framework-spring4shell-and-spring/td-p/294047
  
  And, there was a Signiture Update Yesterday - Select Product and Path at https://downloads.f5.com/esd/productlines.jsp
LiefZimmerman
Admin
May 17, 2023
Accepting PSilva's reply as Solution - if you disagree worapojc feel free to unAccept. Thanks,

Forum Discussion

Does Spring4Shell impacts on F5 AWS WAF?

Recent Discussions

Glucovate Blood Sugar Support Review (2024-2025): Pros, Cons, and Potential Side Effects

F5 Hotfix

Bypass "Bad unescape" in Body POST (ASM, POST, JSON)

URL redirect

Bypass the character for Evasion technique Detected violation

Related Content

Spring4shell iApp

Protect Applications from Spring4Shell. (CVE-2022-22965)

spring4shell iRules yet?

AFM Protocol Custom Signatures for Spring4Shell and Spring_Cloud (CVE-2022-22963 and -22965)

Remove subnet from NAT pools without any impact