Vulnerability remediation for IgnoreExt using OverrideIgnoreExtFilter in SiteMinder

Products

• SITEMINDER
• CA Single Sign On Secure Proxy Server (SiteMinder)
• CA Single Sign On Federation (SiteMinder)
• CA Single Sign On Agents (SiteMinder)

Issue/Introduction

Security scanners may report vulnerabilities (such as path traversal or authentication bypass) when the SiteMinder Web Agent is configured to use the IgnoreExt parameter for performance optimization.

Environment

• Product: SiteMinder (formerly CA Single Sign-On)
• Component: Web Agent / Access Gateway
• Version: 12.8 and higher Access Gateway; 12.52 SP1 and higher Web Agent

Cause

The IgnoreExt parameter instructs the Web Agent to skip all processing for requests matching the specified extensions. While this improves performance for static assets, it prevents the Agent from enforcing security policies or checking for malicious URL characters on those resources.

Resolution

To maintain performance while remediating security findings, implement a targeted override filter and harden URL validation:

1. Configure the Override Filter:
   • Locate the OverrideIgnoreExtFilter parameter in the Agent Configuration Object (ACO).
   • Add the specific URI paths (prefixes) that require protection (e.g., /sensitive-app/).
   • Requests matching these patterns are subject to full authentication even if the file extension is in the IgnoreExt list.
2. Harden URL Character Validation:
   • Update the BadURLChars ACO parameter to include %2e%2e.
   • Example: badurlchars='//,./,/.,/*,*.,~,\,%00-%1f,%7f,%2e%2e'
3. Enable URL Normalization (Access Gateway only):
   • Set DisableDotDotRule = yes in the ACO to ensure the agent resolves path segments before checking filters.