Andre/edgeguard-owasp-feed
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update OWASP CRS rules to v4.29.0

Browse Source 
Automated update via update-feed.sh
CRS version: v4.29.0
Rules extracted: 271
This commit is contained in:
Andre Bolinhas
2026-09-07 18:14:53 +01:00
parent a0496d7fec
commit d6ab346bd3
1 changed files with 3 additions and 233 deletions
Download Patch File Download Diff File Expand all files Collapse all files

236
rulesets.json
View File

@@ -1,5 +1,5 @@
{
"build_datetime": "2026-09-07T17:08:37Z",
"build_datetime": "2026-09-07T17:14:52Z",
"owasp_top_10": {
"version": "2025",
"url": "https://owasp.org/Top10/2025/",
@@ -109,7 +109,7 @@
"name": "CRS Protocol Enforcement",
"version": "4.29.0",
"source": "owasp-crs",
"description": "OWASP CRS v4.29.0 — CRS Protocol Enforcement (18 rules)",
"description": "OWASP CRS v4.29.0 — CRS Protocol Enforcement (9 rules)",
"author": "OWASP CRS Project",
"priority": 15,
"enabled": true,
@@ -157,48 +157,6 @@
"paranoia_level": 1
},
{
"id": "920160",
"name": "Content-Length HTTP header is not numeric",
"pattern": "^\\d+$",
"targets": [
"all"
],
"action": "block",
"score": 10,
"severity": "critical",
"category": "protocol",
"enabled": true,
"tags": [
"attack-protocol",
"paranoia-level/1",
"OWASP_CRS",
"OWASP_CRS/PROTOCOL-ENFORCEMENT",
"capec/1000/210/272"
],
"paranoia_level": 1
},
{
"id": "920210",
"name": "Multiple/Conflicting Connection Header Data Found",
"pattern": "\\b(?:keep-alive|close),\\s?(?:keep-alive|close)\\b",
"targets": [
"all"
],
"action": "block",
"score": 5,
"severity": "medium",
"category": "protocol",
"enabled": true,
"tags": [
"attack-protocol",
"paranoia-level/1",
"OWASP_CRS",
"OWASP_CRS/PROTOCOL-ENFORCEMENT",
"capec/1000/210/272"
],
"paranoia_level": 1
},
{
"id": "920260",
"name": "Unicode Full/Half Width Abuse Attack Attempt",
"pattern": "(?i)%uff[0-9a-f]{2}",
@@ -221,27 +179,6 @@
"paranoia_level": 1
},
{
"id": "920290",
"name": "Empty Host Header",
"pattern": "^$",
"targets": [
"all"
],
"action": "block",
"score": 10,
"severity": "critical",
"category": "protocol",
"enabled": true,
"tags": [
"attack-protocol",
"paranoia-level/1",
"OWASP_CRS",
"OWASP_CRS/PROTOCOL-ENFORCEMENT",
"capec/1000/210/272"
],
"paranoia_level": 1
},
{
"id": "920330",
"name": "Empty User Agent Header",
"pattern": "^$",
@@ -263,69 +200,6 @@
"paranoia_level": 1
},
{
"id": "920350",
"name": "Host header is a numeric IP address",
"pattern": "(?:^([\\d.]+|\\[[\\da-f:]+\\]|[\\da-f:]+)(:[\\d]+)?$)",
"targets": [
"all"
],
"action": "block",
"score": 5,
"severity": "medium",
"category": "protocol",
"enabled": true,
"tags": [
"attack-protocol",
"paranoia-level/1",
"OWASP_CRS",
"OWASP_CRS/PROTOCOL-ENFORCEMENT",
"capec/1000/210/272"
],
"paranoia_level": 1
},
{
"id": "920470",
"name": "Illegal Content-Type header",
"pattern": "^[\\w/.+*-]+(?:\\s?;\\s*(?:action|boundary|charset|component|start(?:-info)?|type|version)\\s?=\\s?['\"\\w.()+,/:=?<>@#*-]+)*$",
"targets": [
"all"
],
"action": "block",
"score": 10,
"severity": "critical",
"category": "protocol",
"enabled": true,
"tags": [
"attack-protocol",
"paranoia-level/1",
"OWASP_CRS",
"OWASP_CRS/PROTOCOL-ENFORCEMENT",
"capec/1000/255/153"
],
"paranoia_level": 1
},
{
"id": "920530",
"name": "Multiple charsets detected in content type header",
"pattern": "charset.*?charset",
"targets": [
"all"
],
"action": "block",
"score": 10,
"severity": "critical",
"category": "protocol",
"enabled": true,
"tags": [
"attack-protocol",
"paranoia-level/1",
"OWASP_CRS",
"OWASP_CRS/PROTOCOL-ENFORCEMENT",
"capec/1000/255/153"
],
"paranoia_level": 1
},
{
"id": "920500",
"name": "Attempt to access a backup or working file",
"pattern": "\\.[^.~]+~(?:/.*|)$",
@@ -347,26 +221,6 @@
"paranoia_level": 1
},
{
"id": "920600",
"name": "Illegal Accept header: charset parameter",
"pattern": "^(?:(?:\\*|[^!\"\\(\\),/:-\\?\\[-\\]\\{\\}]+)/(?:\\*|[^!\"\\(\\),/:-\\?\\[-\\]\\{\\}]+)|\\*)(?:[\\s\\x0b]*;[\\s\\x0b]*(?:charset[\\s\\x0b]*=[\\s\\x0b]*\"?(?:iso-8859-15?|utf-8|windows-1252)\\b\"?|(?:[^\\s\\x0b-\"\\(\\),/:-\\?\\[-\\]c\\{\\}]|c(?:[^!\"\\(\\),/:-\\?\\[-\\]h\\{\\}]|h(?:[^!\"\\(\\),/:-\\?\\[-\\]a\\{\\}]|a(?:[^!\"\\(\\),/:-\\?\\[-\\]r\\{\\}]|r(?:[^!\"\\(\\),/:-\\?\\[-\\]s\\{\\}]|s(?:[^!\"\\(\\),/:-\\?\\[-\\]e\\{\\}]|e[^!\"\\(\\),/:-\\?\\[-\\]t\\{\\}]))))))[^!\"\\(\\),/:-\\?\\[-\\]\\{\\}]*[\\s\\x0b]*=[\\s\\x0b]*[^!\\(\\),/:-\\?\\[-\\]\\{\\}]+);?)*(?:[\\s\\x0b]*,[\\s\\x0b]*(?:(?:\\*|[^!\"\\(\\),/:-\\?\\[-\\]\\{\\}]+)/(?:\\*|[^!\"\\(\\),/:-\\?\\[-\\]\\{\\}]+)|\\*)(?:[\\s\\x0b]*;[\\s\\x0b]*(?:charset[\\s\\x0b]*=[\\s\\x0b]*\"?(?:iso-8859-15?|utf-8|windows-1252)\\b\"?|(?:[^\\s\\x0b-\"\\(\\),/:-\\?\\[-\\]c\\{\\}]|c(?:[^!\"\\(\\),/:-\\?\\[-\\]h\\{\\}]|h(?:[^!\"\\(\\),/:-\\?\\[-\\]a\\{\\}]|a(?:[^!\"\\(\\),/:-\\?\\[-\\]r\\{\\}]|r(?:[^!\"\\(\\),/:-\\?\\[-\\]s\\{\\}]|s(?:[^!\"\\(\\),/:-\\?\\[-\\]e\\{\\}]|e[^!\"\\(\\),/:-\\?\\[-\\]t\\{\\}]))))))[^!\"\\(\\),/:-\\?\\[-\\]\\{\\}]*[\\s\\x0b]*=[\\s\\x0b]*[^!\\(\\),/:-\\?\\[-\\]\\{\\}]+);?)*)*$",
"targets": [
"all"
],
"action": "block",
"score": 10,
"severity": "critical",
"category": "protocol",
"enabled": true,
"tags": [
"attack-protocol",
"paranoia-level/1",
"OWASP_CRS",
"OWASP_CRS/PROTOCOL-ENFORCEMENT"
],
"paranoia_level": 1
},
{
"id": "920540",
"name": "Possible Unicode character bypass detected",
"pattern": "(?i)\\x5cu[0-9a-f]{4}",
@@ -430,48 +284,6 @@
"paranoia_level": 2
},
{
"id": "920521",
"name": "Illegal Accept-Encoding header",
"pattern": "br|compress|deflate|(?:pack200-)?gzip|identity|\\*|^$|aes128gcm|exi|zstd|x-(?:compress|gzip)",
"targets": [
"all"
],
"action": "score",
"score": 10,
"severity": "critical",
"category": "protocol",
"enabled": true,
"tags": [
"attack-protocol",
"paranoia-level/3",
"OWASP_CRS",
"OWASP_CRS/PROTOCOL-ENFORCEMENT",
"capec/1000/255/153"
],
"paranoia_level": 3
},
{
"id": "920275",
"name": "Invalid character in request headers (outside of very strict set)",
"pattern": "^(?:\\?[01])?$",
"targets": [
"all"
],
"action": "score",
"score": 10,
"severity": "critical",
"category": "protocol",
"enabled": true,
"tags": [
"attack-protocol",
"paranoia-level/4",
"OWASP_CRS",
"OWASP_CRS/PROTOCOL-ENFORCEMENT",
"capec/1000/210/272"
],
"paranoia_level": 4
},
{
"id": "920460",
"name": "Abnormal character escapes in request",
"pattern": "(?:^|[^\\x5c])\\x5c[cdeghijklmpqwxyz123456789]",
@@ -499,7 +311,7 @@
"name": "CRS Protocol Attack (HTTP Smuggling)",
"version": "4.29.0",
"source": "owasp-crs",
"description": "OWASP CRS v4.29.0 — CRS Protocol Attack (HTTP Smuggling) (14 rules)",
"description": "OWASP CRS v4.29.0 — CRS Protocol Attack (HTTP Smuggling) (12 rules)",
"author": "OWASP CRS Project",
"priority": 5,
"enabled": true,
@@ -673,27 +485,6 @@
"paranoia_level": 1
},
{
"id": "921421",
"name": "Content-Type header: Dangerous content type outside the mime type declaration",
"pattern": "^[^\\s\\x0b,;]+[\\s\\x0b,;].*?(?:application/(?:.+\\+)?json|(?:application/(?:soap\\+)?|text/)xml)",
"targets": [
"all"
],
"action": "block",
"score": 10,
"severity": "critical",
"category": "protocol",
"enabled": true,
"tags": [
"attack-protocol",
"paranoia-level/1",
"OWASP_CRS",
"OWASP_CRS/PROTOCOL-ATTACK",
"capec/1000/255/153"
],
"paranoia_level": 1
},
{
"id": "921240",
"name": "mod_proxy attack attempt detected",
"pattern": "unix:[^|]*\\|",
@@ -736,27 +527,6 @@
"paranoia_level": 2
},
{
"id": "921422",
"name": "Content-Type header: Dangerous content type outside the mime type declaration",
"pattern": "^[^\\s\\x0b,;]+[\\s\\x0b,;].*?\\b(?:((?:tex|multipar)t|application)|((?:audi|vide)o|image|cs[sv]|(?:vn|relate)d|p(?:df|lain)|json|(?:soa|cs)p|x(?:ml|-www-form-urlencoded)|form-data|x-amf|(?:octe|repor)t|stream)|([\\+/]))\\b",
"targets": [
"all"
],
"action": "score",
"score": 10,
"severity": "critical",
"category": "protocol",
"enabled": true,
"tags": [
"attack-protocol",
"paranoia-level/2",
"OWASP_CRS",
"OWASP_CRS/PROTOCOL-ATTACK",
"capec/1000/255/153"
],
"paranoia_level": 2
},
{
"id": "921210",
"name": "HTTP Parameter Pollution after detecting bogus char after parameter array",
"pattern": "(][^\\]]+$|][^\\]]+\\[)",