Troubleshooting Tip: File upload restriction blocking application traffic 'msg File name Illegal file type' due empty name

In the attack log section, the administrator finds logs with 'File name [N/A]: Illegal file type'.

For more in-depth troubleshooting, the administrator can run debugging commands related to file uploads.

diagnose debug flow filter module-detail file-mime 7
diagnose debug flow filter module-detail file-security 7
diagnose debug flow filter module-detail file-parse 7
diagnose debug flow trace start
diagnose debug timestamp enable
diagnose debug enable

 The administrator will identify patterns about empty file names associated with blocked traffic.

Content-Disposition: form-data; name="archs[]"; filename=""
Content-Type: application/octet-stream

To fix the issue, upgrade FortiWeb to version 7.4.6 and above.

Go to Web Protection -> Input Validation -> Web Security.

In the File Security Rule, move 'Empty File Name' from the 'Special File' category to 'Allowed File Types'.

CLI commands:

config waf file-upload-restriction-rule
    edit "File security"
        set request-file /
            config file-types
                edit 1
                    set file-type-name "Empty File Name"
                    set file-type-id 10000
                next
            end
            config custom-file-types
            end
    next
end

Note:
Open a TAC ticket if the issue remains after adding 'Empty File Name' to 'Allowed File Types'.

Related documents:

Technical Tip: How to create a ticket for Fortinet TAC

Limiting file uploads