Description

This article presents three procedures to include a UTF-8 encoding character in a pattern when creating a custom IDP signature from  the CLI.

Symptoms

When a customer wants to create a custom IDP signature to match a character using a UTF-8 encoding character in the CLI, the CLI parser translate the pattern to a unicode character by mistake. For example, \x22 is translated with a space shown at the end instead and \x27 is translated to '(unicode character) directly. The CLI parser cannot recognize \x22 correctly. 

[edit security idp custom-attack test-apache attack-type signature]
lab@UTM# set pattern "\x22\x27" 

[edit security idp custom-attack test-apache attack-type signature]
lab@UTM# show pattern 
pattern "' ";

In another example, \x21 and \x27 are translated directly to ! and ' which are their corresponding unicode characters. 

[edit security idp custom-attack test-apache attack-type signature]  lab@UTM# set pattern "\x21\x27"     [edit security idp custom-attack test-apache attack-type signature]  lab@UTM# show pattern   pattern "!'";

Solution

This is our current limitation in CLI. It is possible that CLI translates a UTF-8 encoding character to unicode and in particular, \x22 \x27 are escape sequences in C which means these have a specific character.

Three workarounds are available:

  1. Insert \x22 in between: 

[edit security idp custom-attack test-apache attack-type signature]
lab@UTM# set pattern "\x\x2222\x\x2227" 

[edit security idp custom-attack test-apache attack-type signature]
lab@UTM# show 
context http-variable-parsed;
pattern "\x22\x27";
direction client-to-server;
shellcode no-shellcode;
  • Use load set terminal or load replace terminal: 

lab@UTM# load set terminal 
[Type ^D at a new line to end input]
set security idp custom-attack test-apache attack-type signature pattern "\x22\x27"
load complete

[edit]
lab@UTM# show security idp custom-attack test-apache 
recommended-action drop;
severity major;
attack-type {
    signature {
        context http-variable-parsed;
        pattern "\x22\x27";
        direction client-to-server;
        shellcode no-shellcode;
    }
}
  • Load replace terminal: 

[edit security idp custom-attack test-apache]
lab@UTM# show 
recommended-action drop;
severity major;
## Warning: missing mandatory statement(s): 'attack-type'

[edit security idp custom-attack test-apache]
lab@UTM# load replace relative terminal 
[Type ^D at a new line to end input]
attack-type {
    signature {
        context http-variable-parsed;
        pattern "\x22\x27";
        direction client-to-server;
        shellcode no-shellcode;
    }
}

load complete

[edit security idp custom-attack test-apache]
lab@UTM# show 
recommended-action drop;
severity major;
attack-type {
    signature {
        context http-variable-parsed;
        pattern "\x22\x27";
        direction client-to-server;
        shellcode no-shellcode;
    }
}

Related Information