From 843171b9854a67c6558dcb281db60b667112a0da Mon Sep 17 00:00:00 2001 From: Andre Date: Fri, 30 Oct 2026 17:50:16 +0000 Subject: [PATCH] 932180: the /proc file list must be anchored to a path MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Rule 932180 "Restricted File Upload Attempt" targets filename, scores 10 and blocks. Its pattern carries CRS's OS-pseudo-file list with no path anchor, so bare words matched any uploaded filename: module modules meminfo mounts misc mdstat mtrr loadavg locks version uptime cmdline stat swaps slabinfo partitions pagetypeinfo So release-version-2.zip, company-misc-notes.pdf and meminfo.txt were refused as critical RCE attempts. Found because it blocked an image upload to our own wiki, which sits behind EdgeGuard: the response carried x-edgeguard-id, the console found the event by that id, and the match was `module-` in the filename. These names mean something as a PATH and nothing as a filename, so the branch now requires a leading slash. The dotfile branch keeps its own (?:\b|^) anchor and is untouched. Measured against the previous pattern over a corpus of 51 names: 16 ordinary filenames released, NOTHING newly blocked, and every true positive still caught — .htaccess, .env, .aws/credentials, wp-config.php, /proc/version, /proc/self/environ, ../../proc/modules, uploads/../../proc/kcore. build_datetime bumped. An agent skips a feed whose stamp has not changed without reading it, so a corrected pattern under the old stamp would reach nobody. --- rulesets.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rulesets.json b/rulesets.json index e7e3156..cd521c3 100644 --- a/rulesets.json +++ b/rulesets.json @@ -1,5 +1,5 @@ { - "build_datetime": "2026-10-23T00:35:30Z", + "build_datetime": "2026-10-30T17:50:13Z", "owasp_top_10": { "version": "2025", "url": "https://owasp.org/Top10/2025/", @@ -1031,7 +1031,7 @@ { "id": "932180", "name": "Restricted File Upload Attempt", - "pattern": "(?i)(?:\\b|^)(?:\\.(?:a(?:ddressbook|iignore|sh(?:_history|rc))|b(?:ashrc|o(?:to|werrc))|c(?:o(?:ndarc|verage)|(?:redential|v)s|sh(?:_history|rc)|ur(?:lrc|sorignore))|d(?:bshell|igrc|ocker(?:env|ignore))|e(?:ditorconfig|nv(?:rc)?|slint(?:ignore|rc))|f(?:bcindex|ish|orward|tpconfig)|g(?:emrc|it(?:(?:attribut|modul)es|config|ignore|keep)|oogle_authenticator)|h(?:gignore|t(?:access|digest|passwd))|i(?:dea|rb_history)|(?:jshint|offlineimap|yarn)rc|k(?:otlinc_history|sh(?:_history|rc))|l(?:esshst|ftprc|history|ighttpdpassword|ynx_cookies)|m(?:(?:bsync|smtp)rc|ys(?:cmserverinfo|ql_history))|n(?:ano(?:_history|rc)|(?:et|pm)rc|ode_repl_history|s(?:config|r))|p(?:ass(?:wd)?|e(?:arrc|rl(?:(?:_repl_)?history|db))|gpass|(?:hp|sql|ython)_history|inerc|lenv|r(?:ettierrc|o(?:c(?:log|mailrc)|file))|wd)|r(?:ediscli_history|h(?:istory|osts)|sync_exclude|ustup)|s(?:3cfg|creenrc|e(?:crets|lected_editor)|(?:h|ql(?:ite|plus))_history|vnignore)|t(?:csh(?:_history|rc)|erraformrc)|v(?:im(?:info|rc)|scode)|w(?:getrc|ww_?acl)|xauthority|z(?:history|sh(?:_history|env|rc)))|(?:Dockerfil|uptim)e|a(?:cpi|sound)|b(?:lock|ootconfig|uddyinfo)|c(?:(?:group|las|onsole)s|mdline|(?:puinf|rypt)o)|d(?:(?:evice|iskstat)s|(?:ock|riv)er|ynamic_debug)|execdomains|fi(?:(?:lesystem|sh_variable)s|rmware)|hypervisor|i(?:n(?:itial_root_password|terrupts)|o(?:mem|ports)|pmi)|k(?:allsyms|core|e(?:rnel|ys)|msg|page(?:c(?:group|ount)|flags))|l(?:atency_stats|o(?:adavg|cks))|m(?:dstat|eminfo|isc|o(?:dules?|unts)|trr)|p(?:a(?:getypeinfo|rtitions)|ower|ressure)|s(?:c(?:hed(?:_debug|stat)|si)|elf|labinfo|(?:oftirq|wap)s|slvpn_websession|tat|ysvipc)|timer_(?:list|stats)|v(?:ersion(?:_signature)?|m(?:allocinfo|stat))|zoneinfo)(?:[^0-9@-Z_a-z]|$)|\\.(?:a(?:(?:(?:cces|w)s|nydesk|tom|zure)/|ptitude/config)|b(?:ash_|(?:in|luemix)/|un(?:(?:dle)?/|fig\\.toml))|c(?:a(?:che/(?:notify-osd\\.log)?|rgo/)|(?:hocolatey|pan(?:el|plus)?|ups)/|o(?:nfig(?:\\.local\\.php|/)|veralls\\.yml))|d(?:(?:atadog-agent|bus|ocker|rush)/|eployment-secrets\\.txt)|(?:eclipse|i(?:bmcloud|(?:dle|rb)rc|pynb_checkpoints)|java|k(?:(?:aggl|ub)e|eras|onan)|v(?:agrant\\.d|i(?:dalia|m)|mware))/|g(?:(?:e(?:m|t(?:dns|mail))|ftp|n(?:ome(?:2|rc)?|upg)|radle|sutil)/|it(?:-credentials|/|lab-ci\\.yml))|h(?:g/|plip/hplip\\.conf)|l(?:(?:ftp|inode-cli|ocal/(?:bin|lib|s(?:har|tat)e))/|ldb-history)|m(?:(?:2|inikube)/|ongo(?:db/|shrc\\.js)|y(?:(?:login)?\\.cnf|py_cache/))|n(?:(?:ano|cftp|pm(?:-global)?|vm)/|ode-gyp)|o(?:ci/|h-my-|p(?:c/|en(?:ssl\\.cnf|vpn/)))|p(?:assword-store|g(?:_service\\.conf|admin/)|hp(?:_cs\\.dist|cs\\.xml(?:\\.dist)?)|(?:ip|(?:k|ulum)i|m2|ryrc|y(?:env|test_cache))/)|r(?:(?:benv|vm)/|e(?:dhat/|mote-sync\\.json)|ubocop\\.yml)|s(?:(?:(?:dkma|ubversio|v)n|ettings|nap|sh)/|ql\\.(?:(?:00|yz)1|[7bgx]?z|a(?:ce|rj)|cpio|l(?:ha|z)|(?:pe?|uh)a|r(?:0[0-9]|ar|ev)|t(?:a[rz]|[bgx]z))|tubby\\.yml)|t(?:(?:conn|hunderbird|o(?:ols|r))/|erraform(?:\\.(?:d/|lock\\.hcl)|/)|mux\\.conf|ravis\\.ya?ml)|u(?:nbound/|ser(?:\\.ini|min/))|w(?:eb\\.config\\.swp|get-hsts|(?:ine|p-cli)/)|yarnrc\\.yml)|/(?:\\.(?:DS_Store|ws_ftp\\.ini)|@(?:fs|id)/|(?:Web\\.confi|(?:debug|errors?)\\.lo)g|(?:auth|package(?:-lock|s)?)\\.json|composer\\.(?:json|lock)|(?:gruntfile|webpack\\.config)\\.js|npm-(?:debug\\.log|shrinkwrap\\.json)|yarn\\.lock)|(?:BlockCypher|yarn-(?:debug|error))\\.log|Desktop\\.ini|(?:META|WEB)-INF/|Thumbs\\.db|(?:aws(?:-key)?\\.ya?|user_secrets\\.y)ml|b(?:o(?:ot\\.ini|wer\\.json)|uild\\.zig\\.zon)|c(?:argo\\.toml|o(?:(?:mpose\\.ya?|verage\\.x)ml|nfig(?:[\\-_](?:dev|prod|sample|test)\\.(?:asp|ini|json|p(?:hp|[ly])|rb|t(?:oml|xt)|(?:x|ya?)ml)|\\.(?:asp|dev\\.(?:asp|ini|json|p(?:hp|[ly])|rb|t(?:oml|xt)|(?:x|ya?)ml)|fish|gz|in(?:c\\.php|i)|json|nu|p(?:hp|[ly]|rod\\.(?:asp|ini|json|p(?:hp|[ly])|rb|t(?:oml|xt)|(?:x|ya?)ml))|rb|sample\\.(?:asp|in(?:c\\.php|i)|json|p(?:hp|[ly])|rb|t(?:oml|xt)|(?:x|ya?)ml)|t(?:est\\.(?:asp|ini|json|p(?:hp|[ly])|rb|t(?:oml|xt)|(?:x|ya?)ml)|oml|xt)|(?:x|ya?)ml)))|redentials\\.json)|d(?:atabase\\.ya?ml|e(?:b(?:ian\\.cnf|ug\\.log)|fault(?:\\.settings|s\\.inc)\\.php))|env\\.php|ftp-sync\\.json|g(?:itlab(?:\\.rb|_config_)|o\\.(?:mod|sum))|key-users|l(?:dap-authentication-report\\.csv|o(?:cal\\.xm|gin\\.sq)l)|(?:my(?:sql(?:dump)?)?\\.cn|thread-sel)f|p(?:arameters\\.(?:php|yml)|hp(?:\\.ini|_errors?\\.log|cs\\.xml(?:\\.dist)?|info\\.php)|m2\\.log|y(?:project\\.toml|test\\.ini))|r(?:outing\\.yml|sync\\.log)|s(?:e(?:c(?:rets\\.(?:json|ya?ml)|urity\\.yml)|ndgrid\\.env|rvices\\.yml|t(?:tings\\.(?:(?:inc|local)\\.)?php|up\\.py))|ftp\\.json|ys(?:rq-trigger|tem\\.ini))|w(?:eblogic\\.xml|g-clients/|in\\.ini|p-config[\\-\\._])", + "pattern": "(?i)(?:(?:\\b|^)\\.(?:a(?:ddressbook|iignore|sh(?:_history|rc))|b(?:ashrc|o(?:to|werrc))|c(?:o(?:ndarc|verage)|(?:redential|v)s|sh(?:_history|rc)|ur(?:lrc|sorignore))|d(?:bshell|igrc|ocker(?:env|ignore))|e(?:ditorconfig|nv(?:rc)?|slint(?:ignore|rc))|f(?:bcindex|ish|orward|tpconfig)|g(?:emrc|it(?:(?:attribut|modul)es|config|ignore|keep)|oogle_authenticator)|h(?:gignore|t(?:access|digest|passwd))|i(?:dea|rb_history)|(?:jshint|offlineimap|yarn)rc|k(?:otlinc_history|sh(?:_history|rc))|l(?:esshst|ftprc|history|ighttpdpassword|ynx_cookies)|m(?:(?:bsync|smtp)rc|ys(?:cmserverinfo|ql_history))|n(?:ano(?:_history|rc)|(?:et|pm)rc|ode_repl_history|s(?:config|r))|p(?:ass(?:wd)?|e(?:arrc|rl(?:(?:_repl_)?history|db))|gpass|(?:hp|sql|ython)_history|inerc|lenv|r(?:ettierrc|o(?:c(?:log|mailrc)|file))|wd)|r(?:ediscli_history|h(?:istory|osts)|sync_exclude|ustup)|s(?:3cfg|creenrc|e(?:crets|lected_editor)|(?:h|ql(?:ite|plus))_history|vnignore)|t(?:csh(?:_history|rc)|erraformrc)|v(?:im(?:info|rc)|scode)|w(?:getrc|ww_?acl)|xauthority|z(?:history|sh(?:_history|env|rc)))|/(?:(?:Dockerfil|uptim)e|a(?:cpi|sound)|b(?:lock|ootconfig|uddyinfo)|c(?:(?:group|las|onsole)s|mdline|(?:puinf|rypt)o)|d(?:(?:evice|iskstat)s|(?:ock|riv)er|ynamic_debug)|execdomains|fi(?:(?:lesystem|sh_variable)s|rmware)|hypervisor|i(?:n(?:itial_root_password|terrupts)|o(?:mem|ports)|pmi)|k(?:allsyms|core|e(?:rnel|ys)|msg|page(?:c(?:group|ount)|flags))|l(?:atency_stats|o(?:adavg|cks))|m(?:dstat|eminfo|isc|o(?:dules?|unts)|trr)|p(?:a(?:getypeinfo|rtitions)|ower|ressure)|s(?:c(?:hed(?:_debug|stat)|si)|elf|labinfo|(?:oftirq|wap)s|slvpn_websession|tat|ysvipc)|timer_(?:list|stats)|v(?:ersion(?:_signature)?|m(?:allocinfo|stat))|zoneinfo))(?:[^0-9@-Z_a-z]|$)|\\.(?:a(?:(?:(?:cces|w)s|nydesk|tom|zure)/|ptitude/config)|b(?:ash_|(?:in|luemix)/|un(?:(?:dle)?/|fig\\.toml))|c(?:a(?:che/(?:notify-osd\\.log)?|rgo/)|(?:hocolatey|pan(?:el|plus)?|ups)/|o(?:nfig(?:\\.local\\.php|/)|veralls\\.yml))|d(?:(?:atadog-agent|bus|ocker|rush)/|eployment-secrets\\.txt)|(?:eclipse|i(?:bmcloud|(?:dle|rb)rc|pynb_checkpoints)|java|k(?:(?:aggl|ub)e|eras|onan)|v(?:agrant\\.d|i(?:dalia|m)|mware))/|g(?:(?:e(?:m|t(?:dns|mail))|ftp|n(?:ome(?:2|rc)?|upg)|radle|sutil)/|it(?:-credentials|/|lab-ci\\.yml))|h(?:g/|plip/hplip\\.conf)|l(?:(?:ftp|inode-cli|ocal/(?:bin|lib|s(?:har|tat)e))/|ldb-history)|m(?:(?:2|inikube)/|ongo(?:db/|shrc\\.js)|y(?:(?:login)?\\.cnf|py_cache/))|n(?:(?:ano|cftp|pm(?:-global)?|vm)/|ode-gyp)|o(?:ci/|h-my-|p(?:c/|en(?:ssl\\.cnf|vpn/)))|p(?:assword-store|g(?:_service\\.conf|admin/)|hp(?:_cs\\.dist|cs\\.xml(?:\\.dist)?)|(?:ip|(?:k|ulum)i|m2|ryrc|y(?:env|test_cache))/)|r(?:(?:benv|vm)/|e(?:dhat/|mote-sync\\.json)|ubocop\\.yml)|s(?:(?:(?:dkma|ubversio|v)n|ettings|nap|sh)/|ql\\.(?:(?:00|yz)1|[7bgx]?z|a(?:ce|rj)|cpio|l(?:ha|z)|(?:pe?|uh)a|r(?:0[0-9]|ar|ev)|t(?:a[rz]|[bgx]z))|tubby\\.yml)|t(?:(?:conn|hunderbird|o(?:ols|r))/|erraform(?:\\.(?:d/|lock\\.hcl)|/)|mux\\.conf|ravis\\.ya?ml)|u(?:nbound/|ser(?:\\.ini|min/))|w(?:eb\\.config\\.swp|get-hsts|(?:ine|p-cli)/)|yarnrc\\.yml)|/(?:\\.(?:DS_Store|ws_ftp\\.ini)|@(?:fs|id)/|(?:Web\\.confi|(?:debug|errors?)\\.lo)g|(?:auth|package(?:-lock|s)?)\\.json|composer\\.(?:json|lock)|(?:gruntfile|webpack\\.config)\\.js|npm-(?:debug\\.log|shrinkwrap\\.json)|yarn\\.lock)|(?:BlockCypher|yarn-(?:debug|error))\\.log|Desktop\\.ini|(?:META|WEB)-INF/|Thumbs\\.db|(?:aws(?:-key)?\\.ya?|user_secrets\\.y)ml|b(?:o(?:ot\\.ini|wer\\.json)|uild\\.zig\\.zon)|c(?:argo\\.toml|o(?:(?:mpose\\.ya?|verage\\.x)ml|nfig(?:[\\-_](?:dev|prod|sample|test)\\.(?:asp|ini|json|p(?:hp|[ly])|rb|t(?:oml|xt)|(?:x|ya?)ml)|\\.(?:asp|dev\\.(?:asp|ini|json|p(?:hp|[ly])|rb|t(?:oml|xt)|(?:x|ya?)ml)|fish|gz|in(?:c\\.php|i)|json|nu|p(?:hp|[ly]|rod\\.(?:asp|ini|json|p(?:hp|[ly])|rb|t(?:oml|xt)|(?:x|ya?)ml))|rb|sample\\.(?:asp|in(?:c\\.php|i)|json|p(?:hp|[ly])|rb|t(?:oml|xt)|(?:x|ya?)ml)|t(?:est\\.(?:asp|ini|json|p(?:hp|[ly])|rb|t(?:oml|xt)|(?:x|ya?)ml)|oml|xt)|(?:x|ya?)ml)))|redentials\\.json)|d(?:atabase\\.ya?ml|e(?:b(?:ian\\.cnf|ug\\.log)|fault(?:\\.settings|s\\.inc)\\.php))|env\\.php|ftp-sync\\.json|g(?:itlab(?:\\.rb|_config_)|o\\.(?:mod|sum))|key-users|l(?:dap-authentication-report\\.csv|o(?:cal\\.xm|gin\\.sq)l)|(?:my(?:sql(?:dump)?)?\\.cn|thread-sel)f|p(?:arameters\\.(?:php|yml)|hp(?:\\.ini|_errors?\\.log|cs\\.xml(?:\\.dist)?|info\\.php)|m2\\.log|y(?:project\\.toml|test\\.ini))|r(?:outing\\.yml|sync\\.log)|s(?:e(?:c(?:rets\\.(?:json|ya?ml)|urity\\.yml)|ndgrid\\.env|rvices\\.yml|t(?:tings\\.(?:(?:inc|local)\\.)?php|up\\.py))|ftp\\.json|ys(?:rq-trigger|tem\\.ini))|w(?:eblogic\\.xml|g-clients/|in\\.ini|p-config[\\-\\._])", "targets": [ "filename" ],