I’ve been working to add some exclusions for WAF block from the OWASP 3.2 rule set that is occurring for a specific property of a JSON payload which has a base64 value.

The JSON body looks roughly like:

{
    model: {
        owner: {
            ownerSignature: "data:image/png,base64<some base64 data>"
        }
    }
}

This is triggering 3 rules in particular;

• 941130 (payload contains the string ‘base64’)
• 941170 (payload contains strings ‘base64’ and ‘data:’)
• 942450 (payload contains ‘0x’ somewhere)

I’ve tried adding exclusions that cover matching on arg values / arg keys / arg names with the value ‘model.owner.ownerSignature’ and more general exclusions for arg values with ‘base64’ etc, but nothing seems to work reliably.

The documentation is quite lacking on this case, with simple single level JSON request bodies as examples. The general consensus from various MSDN and training articles is to add a custom rule to bypass this, but IMO this defeats the point of the WAF because the managed rule won’t run. Seeking inspiration for how to match this data in an exlu

Thanks in advance