waf xsw-detection rule
Use this command to create XSW Detection rules.
XML Signature Wrapping (XSW) allows a malicious client to modify or forge a digitally signed document without breaking the included signature. This attack is accomplished by moving the original nodeset to another location within the document and replacing the contents.
To counter XSW attacks, FortiWeb will locates the signed node within the XML file and execute verification specifically at that location. Consequently, if a forged node is positioned at the original node's location or the original node is moved to another location, FortiWeb will be able to detect it. In the XSW Detection rule, XPath is employed to specify the correct location of the signed node, while a certificate is used to verify whether the content of the signed node is legitimate.
Syntax
config waf xsw-detection rule
set xml-client-certificate-group
config namespace-mapping
edit "<namespace-mapping_name>"
set prefix <string>
set namespace <string>
next
end
config element-list
edit "<element-list_name>"
set xpath <xpath_str>
set id-attr-name <string>
next
end
end
|
For more information on how to define namespace, XPath, and ID attribute name, please refer to "Creating XSW Detection rules" in FortiWeb Administration Guide. |