waf xsw-detection rule

Use this command to create XSW Detection rules.

XML Signature Wrapping (XSW) allows a malicious client to modify or forge a digitally signed document without breaking the included signature. This attack is accomplished by moving the original nodeset to another location within the document and replacing the contents.

To counter XSW attacks, FortiWeb will locates the signed node within the XML file and execute verification specifically at that location. Consequently, if a forged node is positioned at the original node's location or the original node is moved to another location, FortiWeb will be able to detect it. In the XSW Detection rule, XPath is employed to specify the correct location of the signed node, while a certificate is used to verify whether the content of the signed node is legitimate.

Syntax

config waf xsw-detection rule

set xml-client-certificate-group

config namespace-mapping

edit "<namespace-mapping_name>"

set prefix <string>

set namespace <string>

end

config element-list

edit "<element-list_name>"

set xpath <xpath_str>

set id-attr-name <string>

end

For more information on how to define namespace, XPath, and ID attribute name, please refer to "Creating XSW Detection rules" in FortiWeb Administration Guide.

Variable	Description	Default
"<xsw-detection_rule_name>"	Enter a name that can be referenced by other parts of the configuration.	No default.
xml-client-certificate-group <xml-client-certificate_group_str>	Select the XML client certificate group created from XML Certificate > Client Certificate Group.	No default.
"<namespace-mapping_name_id>"	Enter the index number of an entry to create a namespace mapping.	No default.
namespace <string>	Enter the namespace.	No default.
prefix <string>	Enter a prefix for the namespace.	No default.
"<element-list_name_id>"	Enter the index number of an entry to create an element list.	No default.
xpath <xpath_str>	Enter an XPath to specify which part of the XML file to process.	No default.
id-attr-name <string>	Enter the name of the attribute to be protected.	No default.