FortiWeb denies some uploaded files

Hello dear Abdelkrim, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

Thanks, 

Hello,

We are still looking for an answer to your question.

We will come back to you ASAP.

Thanks,

Hi, do you have the logs ? Its possible reproduce ?? we need to take some captures also I could ask to dev team with information taken :)

Hi Pedro

I could reproduce the same in my lab.

Here are some relevant screenshots. As mentioned it happens when I want to upload a file that contains a known attack signature.

Maybe it is worth mentioning that the protected server is Zimbra webmail.

FortiWeb might be flagging some uploaded files, like PDFs or PNGs, as potential threats due to patterns it detects, such as ${..., which resemble injection attempts. This could be a false positive, where the WAF interprets benign content in the file as an attack because it matches known signatures. To resolve this, review the file contents and the WAF's signature settings. If the files are safe, you can adjust the WAF to reduce false positives by fine-tuning the detection rules or excluding specific file types from scrutiny. This would help ensure that the WAF only blocks genuine threats while allowing legitimate files through.

We worked with TAC support and found that the issue happens on some servers and not seen on others, even if we try upload exactly the same file. This is because not all Web servers upload files in the same way. It seems for some upload methods FWB considers them differently and scans the file for attack signatures, while for other upload methods FWB uses only AV scan as expected. With TAC support we didn't go further, since the issue is not really related to FWB which is actually operating as expected.

As I’m not sot specialist in Web so I’m not aware of which upload methods are causing this issue. Any help on this topic will be welcome.