diff --git a/rulesets.json b/rulesets.json index c063092..bbb7067 100644 --- a/rulesets.json +++ b/rulesets.json @@ -1,5 +1,5 @@ { - "build_datetime": "2026-09-07T17:08:37Z", + "build_datetime": "2026-09-07T17:14:52Z", "owasp_top_10": { "version": "2025", "url": "https://owasp.org/Top10/2025/", @@ -109,7 +109,7 @@ "name": "CRS Protocol Enforcement", "version": "4.29.0", "source": "owasp-crs", - "description": "OWASP CRS v4.29.0 — CRS Protocol Enforcement (18 rules)", + "description": "OWASP CRS v4.29.0 — CRS Protocol Enforcement (9 rules)", "author": "OWASP CRS Project", "priority": 15, "enabled": true, @@ -157,48 +157,6 @@ "paranoia_level": 1 }, { - "id": "920160", - "name": "Content-Length HTTP header is not numeric", - "pattern": "^\\d+$", - "targets": [ - "all" - ], - "action": "block", - "score": 10, - "severity": "critical", - "category": "protocol", - "enabled": true, - "tags": [ - "attack-protocol", - "paranoia-level/1", - "OWASP_CRS", - "OWASP_CRS/PROTOCOL-ENFORCEMENT", - "capec/1000/210/272" - ], - "paranoia_level": 1 - }, - { - "id": "920210", - "name": "Multiple/Conflicting Connection Header Data Found", - "pattern": "\\b(?:keep-alive|close),\\s?(?:keep-alive|close)\\b", - "targets": [ - "all" - ], - "action": "block", - "score": 5, - "severity": "medium", - "category": "protocol", - "enabled": true, - "tags": [ - "attack-protocol", - "paranoia-level/1", - "OWASP_CRS", - "OWASP_CRS/PROTOCOL-ENFORCEMENT", - "capec/1000/210/272" - ], - "paranoia_level": 1 - }, - { "id": "920260", "name": "Unicode Full/Half Width Abuse Attack Attempt", "pattern": "(?i)%uff[0-9a-f]{2}", @@ -221,27 +179,6 @@ "paranoia_level": 1 }, { - "id": "920290", - "name": "Empty Host Header", - "pattern": "^$", - "targets": [ - "all" - ], - "action": "block", - "score": 10, - "severity": "critical", - "category": "protocol", - "enabled": true, - "tags": [ - "attack-protocol", - "paranoia-level/1", - "OWASP_CRS", - "OWASP_CRS/PROTOCOL-ENFORCEMENT", - "capec/1000/210/272" - ], - "paranoia_level": 1 - }, - { "id": "920330", "name": "Empty User Agent Header", "pattern": "^$", @@ -263,69 +200,6 @@ "paranoia_level": 1 }, { - "id": "920350", - "name": "Host header is a numeric IP address", - "pattern": "(?:^([\\d.]+|\\[[\\da-f:]+\\]|[\\da-f:]+)(:[\\d]+)?$)", - "targets": [ - "all" - ], - "action": "block", - "score": 5, - "severity": "medium", - "category": "protocol", - "enabled": true, - "tags": [ - "attack-protocol", - "paranoia-level/1", - "OWASP_CRS", - "OWASP_CRS/PROTOCOL-ENFORCEMENT", - "capec/1000/210/272" - ], - "paranoia_level": 1 - }, - { - "id": "920470", - "name": "Illegal Content-Type header", - "pattern": "^[\\w/.+*-]+(?:\\s?;\\s*(?:action|boundary|charset|component|start(?:-info)?|type|version)\\s?=\\s?['\"\\w.()+,/:=?<>@#*-]+)*$", - "targets": [ - "all" - ], - "action": "block", - "score": 10, - "severity": "critical", - "category": "protocol", - "enabled": true, - "tags": [ - "attack-protocol", - "paranoia-level/1", - "OWASP_CRS", - "OWASP_CRS/PROTOCOL-ENFORCEMENT", - "capec/1000/255/153" - ], - "paranoia_level": 1 - }, - { - "id": "920530", - "name": "Multiple charsets detected in content type header", - "pattern": "charset.*?charset", - "targets": [ - "all" - ], - "action": "block", - "score": 10, - "severity": "critical", - "category": "protocol", - "enabled": true, - "tags": [ - "attack-protocol", - "paranoia-level/1", - "OWASP_CRS", - "OWASP_CRS/PROTOCOL-ENFORCEMENT", - "capec/1000/255/153" - ], - "paranoia_level": 1 - }, - { "id": "920500", "name": "Attempt to access a backup or working file", "pattern": "\\.[^.~]+~(?:/.*|)$", @@ -347,26 +221,6 @@ "paranoia_level": 1 }, { - "id": "920600", - "name": "Illegal Accept header: charset parameter", - "pattern": "^(?:(?:\\*|[^!\"\\(\\),/:-\\?\\[-\\]\\{\\}]+)/(?:\\*|[^!\"\\(\\),/:-\\?\\[-\\]\\{\\}]+)|\\*)(?:[\\s\\x0b]*;[\\s\\x0b]*(?:charset[\\s\\x0b]*=[\\s\\x0b]*\"?(?:iso-8859-15?|utf-8|windows-1252)\\b\"?|(?:[^\\s\\x0b-\"\\(\\),/:-\\?\\[-\\]c\\{\\}]|c(?:[^!\"\\(\\),/:-\\?\\[-\\]h\\{\\}]|h(?:[^!\"\\(\\),/:-\\?\\[-\\]a\\{\\}]|a(?:[^!\"\\(\\),/:-\\?\\[-\\]r\\{\\}]|r(?:[^!\"\\(\\),/:-\\?\\[-\\]s\\{\\}]|s(?:[^!\"\\(\\),/:-\\?\\[-\\]e\\{\\}]|e[^!\"\\(\\),/:-\\?\\[-\\]t\\{\\}]))))))[^!\"\\(\\),/:-\\?\\[-\\]\\{\\}]*[\\s\\x0b]*=[\\s\\x0b]*[^!\\(\\),/:-\\?\\[-\\]\\{\\}]+);?)*(?:[\\s\\x0b]*,[\\s\\x0b]*(?:(?:\\*|[^!\"\\(\\),/:-\\?\\[-\\]\\{\\}]+)/(?:\\*|[^!\"\\(\\),/:-\\?\\[-\\]\\{\\}]+)|\\*)(?:[\\s\\x0b]*;[\\s\\x0b]*(?:charset[\\s\\x0b]*=[\\s\\x0b]*\"?(?:iso-8859-15?|utf-8|windows-1252)\\b\"?|(?:[^\\s\\x0b-\"\\(\\),/:-\\?\\[-\\]c\\{\\}]|c(?:[^!\"\\(\\),/:-\\?\\[-\\]h\\{\\}]|h(?:[^!\"\\(\\),/:-\\?\\[-\\]a\\{\\}]|a(?:[^!\"\\(\\),/:-\\?\\[-\\]r\\{\\}]|r(?:[^!\"\\(\\),/:-\\?\\[-\\]s\\{\\}]|s(?:[^!\"\\(\\),/:-\\?\\[-\\]e\\{\\}]|e[^!\"\\(\\),/:-\\?\\[-\\]t\\{\\}]))))))[^!\"\\(\\),/:-\\?\\[-\\]\\{\\}]*[\\s\\x0b]*=[\\s\\x0b]*[^!\\(\\),/:-\\?\\[-\\]\\{\\}]+);?)*)*$", - "targets": [ - "all" - ], - "action": "block", - "score": 10, - "severity": "critical", - "category": "protocol", - "enabled": true, - "tags": [ - "attack-protocol", - "paranoia-level/1", - "OWASP_CRS", - "OWASP_CRS/PROTOCOL-ENFORCEMENT" - ], - "paranoia_level": 1 - }, - { "id": "920540", "name": "Possible Unicode character bypass detected", "pattern": "(?i)\\x5cu[0-9a-f]{4}", @@ -430,48 +284,6 @@ "paranoia_level": 2 }, { - "id": "920521", - "name": "Illegal Accept-Encoding header", - "pattern": "br|compress|deflate|(?:pack200-)?gzip|identity|\\*|^$|aes128gcm|exi|zstd|x-(?:compress|gzip)", - "targets": [ - "all" - ], - "action": "score", - "score": 10, - "severity": "critical", - "category": "protocol", - "enabled": true, - "tags": [ - "attack-protocol", - "paranoia-level/3", - "OWASP_CRS", - "OWASP_CRS/PROTOCOL-ENFORCEMENT", - "capec/1000/255/153" - ], - "paranoia_level": 3 - }, - { - "id": "920275", - "name": "Invalid character in request headers (outside of very strict set)", - "pattern": "^(?:\\?[01])?$", - "targets": [ - "all" - ], - "action": "score", - "score": 10, - "severity": "critical", - "category": "protocol", - "enabled": true, - "tags": [ - "attack-protocol", - "paranoia-level/4", - "OWASP_CRS", - "OWASP_CRS/PROTOCOL-ENFORCEMENT", - "capec/1000/210/272" - ], - "paranoia_level": 4 - }, - { "id": "920460", "name": "Abnormal character escapes in request", "pattern": "(?:^|[^\\x5c])\\x5c[cdeghijklmpqwxyz123456789]", @@ -499,7 +311,7 @@ "name": "CRS Protocol Attack (HTTP Smuggling)", "version": "4.29.0", "source": "owasp-crs", - "description": "OWASP CRS v4.29.0 — CRS Protocol Attack (HTTP Smuggling) (14 rules)", + "description": "OWASP CRS v4.29.0 — CRS Protocol Attack (HTTP Smuggling) (12 rules)", "author": "OWASP CRS Project", "priority": 5, "enabled": true, @@ -673,27 +485,6 @@ "paranoia_level": 1 }, { - "id": "921421", - "name": "Content-Type header: Dangerous content type outside the mime type declaration", - "pattern": "^[^\\s\\x0b,;]+[\\s\\x0b,;].*?(?:application/(?:.+\\+)?json|(?:application/(?:soap\\+)?|text/)xml)", - "targets": [ - "all" - ], - "action": "block", - "score": 10, - "severity": "critical", - "category": "protocol", - "enabled": true, - "tags": [ - "attack-protocol", - "paranoia-level/1", - "OWASP_CRS", - "OWASP_CRS/PROTOCOL-ATTACK", - "capec/1000/255/153" - ], - "paranoia_level": 1 - }, - { "id": "921240", "name": "mod_proxy attack attempt detected", "pattern": "unix:[^|]*\\|", @@ -736,27 +527,6 @@ "paranoia_level": 2 }, { - "id": "921422", - "name": "Content-Type header: Dangerous content type outside the mime type declaration", - "pattern": "^[^\\s\\x0b,;]+[\\s\\x0b,;].*?\\b(?:((?:tex|multipar)t|application)|((?:audi|vide)o|image|cs[sv]|(?:vn|relate)d|p(?:df|lain)|json|(?:soa|cs)p|x(?:ml|-www-form-urlencoded)|form-data|x-amf|(?:octe|repor)t|stream)|([\\+/]))\\b", - "targets": [ - "all" - ], - "action": "score", - "score": 10, - "severity": "critical", - "category": "protocol", - "enabled": true, - "tags": [ - "attack-protocol", - "paranoia-level/2", - "OWASP_CRS", - "OWASP_CRS/PROTOCOL-ATTACK", - "capec/1000/255/153" - ], - "paranoia_level": 2 - }, - { "id": "921210", "name": "HTTP Parameter Pollution after detecting bogus char after parameter array", "pattern": "(][^\\]]+$|][^\\]]+\\[)",