Update OWASP CRS rules to v4.24.0
Automated update via update-feed.sh CRS version: v4.24.0 Rules extracted: 281
This commit is contained in:
Andre committed
1 parent
6b9b1ceba3
commit
f1bf0e1c70
1 file changed
+8
-590
+8
-590
@@ -108,7 +108,7 @@
|
|||||||
"name": "CRS Protocol Enforcement",
|
"name": "CRS Protocol Enforcement",
|
||||||
"version": "4.24.0",
|
"version": "4.24.0",
|
||||||
"source": "owasp-crs",
|
"source": "owasp-crs",
|
||||||
"description": "OWASP CRS v4.24.0 — CRS Protocol Enforcement (30 rules)",
|
"description": "OWASP CRS v4.24.0 — CRS Protocol Enforcement (17 rules)",
|
||||||
"author": "OWASP CRS Project",
|
"author": "OWASP CRS Project",
|
||||||
"priority": 15,
|
"priority": 15,
|
||||||
"enabled": true,
|
"enabled": true,
|
||||||
@@ -173,66 +173,6 @@
|
|||||||
"capec/1000/210/272"
|
"capec/1000/210/272"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
|
||||||
"id": "920170",
|
|
||||||
"name": "GET or HEAD Request with Body Content",
|
|
||||||
"pattern": "^(?:GET|HEAD)$",
|
|
||||||
"targets": [
|
|
||||||
"all"
|
|
||||||
],
|
|
||||||
"action": "block",
|
|
||||||
"score": 10,
|
|
||||||
"severity": "critical",
|
|
||||||
"category": "protocol",
|
|
||||||
"enabled": true,
|
|
||||||
"tags": [
|
|
||||||
"attack-protocol",
|
|
||||||
"paranoia-level/1",
|
|
||||||
"OWASP_CRS",
|
|
||||||
"OWASP_CRS/PROTOCOL-ENFORCEMENT",
|
|
||||||
"capec/1000/210/272"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"id": "920171",
|
|
||||||
"name": "GET or HEAD Request with Transfer-Encoding",
|
|
||||||
"pattern": "^(?:GET|HEAD)$",
|
|
||||||
"targets": [
|
|
||||||
"all"
|
|
||||||
],
|
|
||||||
"action": "block",
|
|
||||||
"score": 10,
|
|
||||||
"severity": "critical",
|
|
||||||
"category": "protocol",
|
|
||||||
"enabled": true,
|
|
||||||
"tags": [
|
|
||||||
"attack-protocol",
|
|
||||||
"paranoia-level/1",
|
|
||||||
"OWASP_CRS",
|
|
||||||
"OWASP_CRS/PROTOCOL-ENFORCEMENT",
|
|
||||||
"capec/1000/210/272"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"id": "920190",
|
|
||||||
"name": "Range: Invalid Last Byte Value",
|
|
||||||
"pattern": "(\\d+)-(\\d+)",
|
|
||||||
"targets": [
|
|
||||||
"headers"
|
|
||||||
],
|
|
||||||
"action": "block",
|
|
||||||
"score": 5,
|
|
||||||
"severity": "medium",
|
|
||||||
"category": "protocol",
|
|
||||||
"enabled": true,
|
|
||||||
"tags": [
|
|
||||||
"attack-protocol",
|
|
||||||
"paranoia-level/1",
|
|
||||||
"OWASP_CRS",
|
|
||||||
"OWASP_CRS/PROTOCOL-ENFORCEMENT",
|
|
||||||
"capec/1000/210/272"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"id": "920210",
|
"id": "920210",
|
||||||
"name": "Multiple/Conflicting Connection Header Data Found",
|
"name": "Multiple/Conflicting Connection Header Data Found",
|
||||||
@@ -294,46 +234,6 @@
|
|||||||
"capec/1000/210/272"
|
"capec/1000/210/272"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
|
||||||
"id": "920310",
|
|
||||||
"name": "Request Has an Empty Accept Header",
|
|
||||||
"pattern": "^$",
|
|
||||||
"targets": [
|
|
||||||
"headers"
|
|
||||||
],
|
|
||||||
"action": "block",
|
|
||||||
"score": 3,
|
|
||||||
"severity": "low",
|
|
||||||
"category": "protocol",
|
|
||||||
"enabled": true,
|
|
||||||
"tags": [
|
|
||||||
"attack-protocol",
|
|
||||||
"paranoia-level/1",
|
|
||||||
"OWASP_CRS",
|
|
||||||
"OWASP_CRS/PROTOCOL-ENFORCEMENT",
|
|
||||||
"capec/1000/210/272"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"id": "920311",
|
|
||||||
"name": "Request Has an Empty Accept Header",
|
|
||||||
"pattern": "^$",
|
|
||||||
"targets": [
|
|
||||||
"headers"
|
|
||||||
],
|
|
||||||
"action": "block",
|
|
||||||
"score": 3,
|
|
||||||
"severity": "low",
|
|
||||||
"category": "protocol",
|
|
||||||
"enabled": true,
|
|
||||||
"tags": [
|
|
||||||
"attack-protocol",
|
|
||||||
"paranoia-level/1",
|
|
||||||
"OWASP_CRS",
|
|
||||||
"OWASP_CRS/PROTOCOL-ENFORCEMENT",
|
|
||||||
"capec/1000/210/272"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"id": "920330",
|
"id": "920330",
|
||||||
"name": "Empty User Agent Header",
|
"name": "Empty User Agent Header",
|
||||||
@@ -354,26 +254,6 @@
|
|||||||
"capec/1000/210/272"
|
"capec/1000/210/272"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
|
||||||
"id": "920340",
|
|
||||||
"name": "Content-Type header missing from request with non-zero Content-Length",
|
|
||||||
"pattern": "^0$",
|
|
||||||
"targets": [
|
|
||||||
"headers"
|
|
||||||
],
|
|
||||||
"action": "block",
|
|
||||||
"score": 10,
|
|
||||||
"severity": "critical",
|
|
||||||
"category": "protocol",
|
|
||||||
"enabled": true,
|
|
||||||
"tags": [
|
|
||||||
"attack-protocol",
|
|
||||||
"paranoia-level/1",
|
|
||||||
"OWASP_CRS",
|
|
||||||
"OWASP_CRS/PROTOCOL-ENFORCEMENT",
|
|
||||||
"capec/1000/210/272"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"id": "920350",
|
"id": "920350",
|
||||||
"name": "Host header is a numeric IP address",
|
"name": "Host header is a numeric IP address",
|
||||||
@@ -414,46 +294,6 @@
|
|||||||
"capec/1000/255/153"
|
"capec/1000/255/153"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
|
||||||
"id": "920420",
|
|
||||||
"name": "Request content type is not allowed by policy",
|
|
||||||
"pattern": "^[^;\\s]+",
|
|
||||||
"targets": [
|
|
||||||
"headers"
|
|
||||||
],
|
|
||||||
"action": "block",
|
|
||||||
"score": 10,
|
|
||||||
"severity": "critical",
|
|
||||||
"category": "protocol",
|
|
||||||
"enabled": true,
|
|
||||||
"tags": [
|
|
||||||
"attack-protocol",
|
|
||||||
"paranoia-level/1",
|
|
||||||
"OWASP_CRS",
|
|
||||||
"OWASP_CRS/PROTOCOL-ENFORCEMENT",
|
|
||||||
"capec/1000/255/153"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"id": "920480",
|
|
||||||
"name": "Request content type charset is not allowed by policy",
|
|
||||||
"pattern": "charset\\s*=\\s*[\"']?([^;\"'\\s]+)",
|
|
||||||
"targets": [
|
|
||||||
"headers"
|
|
||||||
],
|
|
||||||
"action": "block",
|
|
||||||
"score": 10,
|
|
||||||
"severity": "critical",
|
|
||||||
"category": "protocol",
|
|
||||||
"enabled": true,
|
|
||||||
"tags": [
|
|
||||||
"attack-protocol",
|
|
||||||
"paranoia-level/1",
|
|
||||||
"OWASP_CRS",
|
|
||||||
"OWASP_CRS/PROTOCOL-ENFORCEMENT",
|
|
||||||
"capec/1000/255/153"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"id": "920530",
|
"id": "920530",
|
||||||
"name": "Multiple charsets detected in content type header",
|
"name": "Multiple charsets detected in content type header",
|
||||||
@@ -474,26 +314,6 @@
|
|||||||
"capec/1000/255/153"
|
"capec/1000/255/153"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
|
||||||
"id": "920440",
|
|
||||||
"name": "URL file extension is restricted by policy",
|
|
||||||
"pattern": "\\.([^.]+)$",
|
|
||||||
"targets": [
|
|
||||||
"uri"
|
|
||||||
],
|
|
||||||
"action": "block",
|
|
||||||
"score": 10,
|
|
||||||
"severity": "critical",
|
|
||||||
"category": "protocol",
|
|
||||||
"enabled": true,
|
|
||||||
"tags": [
|
|
||||||
"attack-protocol",
|
|
||||||
"paranoia-level/1",
|
|
||||||
"OWASP_CRS",
|
|
||||||
"OWASP_CRS/PROTOCOL-ENFORCEMENT",
|
|
||||||
"capec/1000/210/272"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"id": "920500",
|
"id": "920500",
|
||||||
"name": "Attempt to access a backup or working file",
|
"name": "Attempt to access a backup or working file",
|
||||||
@@ -514,26 +334,6 @@
|
|||||||
"capec/1000/210/272"
|
"capec/1000/210/272"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
|
||||||
"id": "920450",
|
|
||||||
"name": "HTTP header is restricted by policy (%{MATCHED_VAR})",
|
|
||||||
"pattern": "^.*$",
|
|
||||||
"targets": [
|
|
||||||
"headers"
|
|
||||||
],
|
|
||||||
"action": "block",
|
|
||||||
"score": 10,
|
|
||||||
"severity": "critical",
|
|
||||||
"category": "protocol",
|
|
||||||
"enabled": true,
|
|
||||||
"tags": [
|
|
||||||
"attack-protocol",
|
|
||||||
"paranoia-level/1",
|
|
||||||
"OWASP_CRS",
|
|
||||||
"OWASP_CRS/PROTOCOL-ENFORCEMENT",
|
|
||||||
"capec/1000/210/272"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"id": "920600",
|
"id": "920600",
|
||||||
"name": "Illegal Accept header: charset parameter",
|
"name": "Illegal Accept header: charset parameter",
|
||||||
@@ -553,26 +353,6 @@
|
|||||||
"OWASP_CRS/PROTOCOL-ENFORCEMENT"
|
"OWASP_CRS/PROTOCOL-ENFORCEMENT"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
|
||||||
"id": "920200",
|
|
||||||
"name": "Range: Too many fields (6 or more)",
|
|
||||||
"pattern": "^bytes=(?:(?:\\d+)?-(?:\\d+)?\\s*,?\\s*){6}",
|
|
||||||
"targets": [
|
|
||||||
"headers"
|
|
||||||
],
|
|
||||||
"action": "block",
|
|
||||||
"score": 5,
|
|
||||||
"severity": "medium",
|
|
||||||
"category": "protocol",
|
|
||||||
"enabled": true,
|
|
||||||
"tags": [
|
|
||||||
"attack-protocol",
|
|
||||||
"paranoia-level/2",
|
|
||||||
"OWASP_CRS",
|
|
||||||
"OWASP_CRS/PROTOCOL-ENFORCEMENT",
|
|
||||||
"capec/1000/210/272"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"id": "920230",
|
"id": "920230",
|
||||||
"name": "Multiple URL Encoding Detected",
|
"name": "Multiple URL Encoding Detected",
|
||||||
@@ -613,46 +393,6 @@
|
|||||||
"capec/1000/210/272"
|
"capec/1000/210/272"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
|
||||||
"id": "920451",
|
|
||||||
"name": "HTTP header is restricted by policy (%{MATCHED_VAR})",
|
|
||||||
"pattern": "^.*$",
|
|
||||||
"targets": [
|
|
||||||
"headers"
|
|
||||||
],
|
|
||||||
"action": "block",
|
|
||||||
"score": 10,
|
|
||||||
"severity": "critical",
|
|
||||||
"category": "protocol",
|
|
||||||
"enabled": true,
|
|
||||||
"tags": [
|
|
||||||
"attack-protocol",
|
|
||||||
"paranoia-level/2",
|
|
||||||
"OWASP_CRS",
|
|
||||||
"OWASP_CRS/PROTOCOL-ENFORCEMENT",
|
|
||||||
"capec/1000/210/272"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"id": "920240",
|
|
||||||
"name": "URL Encoding Abuse Attack Attempt",
|
|
||||||
"pattern": "^(?i)application/x-www-form-urlencoded",
|
|
||||||
"targets": [
|
|
||||||
"headers"
|
|
||||||
],
|
|
||||||
"action": "block",
|
|
||||||
"score": 5,
|
|
||||||
"severity": "medium",
|
|
||||||
"category": "protocol",
|
|
||||||
"enabled": true,
|
|
||||||
"tags": [
|
|
||||||
"attack-protocol",
|
|
||||||
"paranoia-level/2",
|
|
||||||
"OWASP_CRS",
|
|
||||||
"OWASP_CRS/PROTOCOL-ENFORCEMENT",
|
|
||||||
"capec/1000/255/153/267/72"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"id": "920521",
|
"id": "920521",
|
||||||
"name": "Illegal Accept-Encoding header",
|
"name": "Illegal Accept-Encoding header",
|
||||||
@@ -1138,7 +878,7 @@
|
|||||||
"name": "CRS Remote File Inclusion (RFI)",
|
"name": "CRS Remote File Inclusion (RFI)",
|
||||||
"version": "4.24.0",
|
"version": "4.24.0",
|
||||||
"source": "owasp-crs",
|
"source": "owasp-crs",
|
||||||
"description": "OWASP CRS v4.24.0 — CRS Remote File Inclusion (RFI) (5 rules)",
|
"description": "OWASP CRS v4.24.0 — CRS Remote File Inclusion (RFI) (4 rules)",
|
||||||
"author": "OWASP CRS Project",
|
"author": "OWASP CRS Project",
|
||||||
"priority": 5,
|
"priority": 5,
|
||||||
"enabled": true,
|
"enabled": true,
|
||||||
@@ -1205,26 +945,6 @@
|
|||||||
"capec/1000/152/175/253"
|
"capec/1000/152/175/253"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
|
||||||
"id": "931130",
|
|
||||||
"name": "Possible Remote File Inclusion (RFI) Attack: Off-Domain Reference/Link",
|
|
||||||
"pattern": "(?i)(?:(?:url|jar):)?(?:a(?:cap|f[ps]|ttachment)|b(?:eshare|itcoin|lob)|c(?:a(?:llto|p)|id|vs|ompress.(?:zlib|bzip2))|d(?:a(?:v|ta)|ict|n(?:s|tp))|e(?:d2k|xpect)|f(?:(?:ee)?d|i(?:le|nger|sh)|tps?)|g(?:it|o(?:pher)?|lob)|h(?:323|ttps?)|i(?:ax|cap|(?:ma|p)ps?|rc[6s]?)|ja(?:bbe)?r|l(?:dap[is]?|ocal_file)|m(?:a(?:ilto|ven)|ms|umble)|n(?:e(?:tdoc|ws)|fs|ntps?)|ogg|p(?:aparazzi|h(?:ar|p)|op(?:2|3s?)|r(?:es|oxy)|syc)|r(?:mi|sync|tm(?:f?p)?|ar)|s(?:3|ftp|ips?|m(?:[bs]|tps?)|n(?:ews|mp)|sh(?:2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?)?|vn(?:\\+ssh)?)|t(?:e(?:amspeak|lnet)|ftp|urns?)|u(?:dp|nreal|t2004)|v(?:entrilo|iew-source|nc)|w(?:ebcal|ss?)|x(?:mpp|ri)|zip)://?(?:[^@]+@)?([^/]*)",
|
|
||||||
"targets": [
|
|
||||||
"query"
|
|
||||||
],
|
|
||||||
"action": "block",
|
|
||||||
"score": 10,
|
|
||||||
"severity": "critical",
|
|
||||||
"category": "rfi",
|
|
||||||
"enabled": true,
|
|
||||||
"tags": [
|
|
||||||
"attack-rfi",
|
|
||||||
"paranoia-level/2",
|
|
||||||
"OWASP_CRS",
|
|
||||||
"OWASP_CRS/ATTACK-RFI",
|
|
||||||
"capec/1000/152/175/253"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"id": "931131",
|
"id": "931131",
|
||||||
"name": "Possible Remote File Inclusion (RFI) Attack",
|
"name": "Possible Remote File Inclusion (RFI) Attack",
|
||||||
@@ -1252,7 +972,7 @@
|
|||||||
"name": "CRS Remote Code Execution (RCE)",
|
"name": "CRS Remote Code Execution (RCE)",
|
||||||
"version": "4.24.0",
|
"version": "4.24.0",
|
||||||
"source": "owasp-crs",
|
"source": "owasp-crs",
|
||||||
"description": "OWASP CRS v4.24.0 — CRS Remote Code Execution (RCE) (42 rules)",
|
"description": "OWASP CRS v4.24.0 — CRS Remote Code Execution (RCE) (37 rules)",
|
||||||
"author": "OWASP CRS Project",
|
"author": "OWASP CRS Project",
|
||||||
"priority": 3,
|
"priority": 3,
|
||||||
"enabled": true,
|
"enabled": true,
|
||||||
@@ -1638,86 +1358,6 @@
|
|||||||
"capec/1000/152/248/88"
|
"capec/1000/152/248/88"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
|
||||||
"id": "932200",
|
|
||||||
"name": "RCE Bypass Technique",
|
|
||||||
"pattern": "['\\*\\?\\x5c`][^\\n/]+/|/[^/]+?['\\*\\?\\x5c`]|\\$[!#\\$\\(\\*\\-0-9\\?-\\[_a-\\{]",
|
|
||||||
"targets": [
|
|
||||||
"all"
|
|
||||||
],
|
|
||||||
"action": "block",
|
|
||||||
"score": 10,
|
|
||||||
"severity": "critical",
|
|
||||||
"category": "rce",
|
|
||||||
"enabled": true,
|
|
||||||
"tags": [
|
|
||||||
"attack-rce",
|
|
||||||
"paranoia-level/2",
|
|
||||||
"OWASP_CRS",
|
|
||||||
"OWASP_CRS/ATTACK-RCE",
|
|
||||||
"capec/1000/152/248/88"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"id": "932205",
|
|
||||||
"name": "RCE Bypass Technique",
|
|
||||||
"pattern": "^[^#]+",
|
|
||||||
"targets": [
|
|
||||||
"headers"
|
|
||||||
],
|
|
||||||
"action": "block",
|
|
||||||
"score": 10,
|
|
||||||
"severity": "critical",
|
|
||||||
"category": "rce",
|
|
||||||
"enabled": true,
|
|
||||||
"tags": [
|
|
||||||
"attack-rce",
|
|
||||||
"paranoia-level/2",
|
|
||||||
"OWASP_CRS",
|
|
||||||
"OWASP_CRS/ATTACK-RCE",
|
|
||||||
"capec/1000/152/248/88"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"id": "932206",
|
|
||||||
"name": "RCE Bypass Technique",
|
|
||||||
"pattern": "^[^\\.]*?(?:['\\*\\?\\x5c`][^\\n/]+/|/[^/]+?['\\*\\?\\x5c`]|\\$[!#\\$\\(\\*\\-0-9\\?-\\[_a-\\{])",
|
|
||||||
"targets": [
|
|
||||||
"headers"
|
|
||||||
],
|
|
||||||
"action": "block",
|
|
||||||
"score": 10,
|
|
||||||
"severity": "critical",
|
|
||||||
"category": "rce",
|
|
||||||
"enabled": true,
|
|
||||||
"tags": [
|
|
||||||
"attack-rce",
|
|
||||||
"paranoia-level/2",
|
|
||||||
"OWASP_CRS",
|
|
||||||
"OWASP_CRS/ATTACK-RCE",
|
|
||||||
"capec/1000/152/248/88"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"id": "932207",
|
|
||||||
"name": "RCE Bypass Technique",
|
|
||||||
"pattern": "#.*",
|
|
||||||
"targets": [
|
|
||||||
"headers"
|
|
||||||
],
|
|
||||||
"action": "block",
|
|
||||||
"score": 10,
|
|
||||||
"severity": "critical",
|
|
||||||
"category": "rce",
|
|
||||||
"enabled": true,
|
|
||||||
"tags": [
|
|
||||||
"attack-rce",
|
|
||||||
"paranoia-level/2",
|
|
||||||
"OWASP_CRS",
|
|
||||||
"OWASP_CRS/ATTACK-RCE",
|
|
||||||
"capec/1000/152/248/88"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"id": "932220",
|
"id": "932220",
|
||||||
"name": "Remote Command Execution: Unix Command Injection with pipe",
|
"name": "Remote Command Execution: Unix Command Injection with pipe",
|
||||||
@@ -1738,26 +1378,6 @@
|
|||||||
"capec/1000/152/248/88"
|
"capec/1000/152/248/88"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
|
||||||
"id": "932240",
|
|
||||||
"name": "Remote Command Execution: Unix Command Injection evasion attempt detected",
|
|
||||||
"pattern": "(?i)[\\-0-9_a-z]+(?:[\\s\\x0b]*[\"'][^\\s\\x0b\"',:]+[\"']|(?:[\"'][\"']+|[\\[-\\]]+|\\$+[!#\\*\\-0-9\\?@\\x5c_a-\\{]+|``|[\\$<>]\\(\\))[\\s\\x0b]*)[\\-0-9_a-z]+",
|
|
||||||
"targets": [
|
|
||||||
"all"
|
|
||||||
],
|
|
||||||
"action": "block",
|
|
||||||
"score": 10,
|
|
||||||
"severity": "critical",
|
|
||||||
"category": "rce",
|
|
||||||
"enabled": true,
|
|
||||||
"tags": [
|
|
||||||
"attack-rce",
|
|
||||||
"paranoia-level/2",
|
|
||||||
"OWASP_CRS",
|
|
||||||
"OWASP_CRS/ATTACK-RCE",
|
|
||||||
"capec/1000/152/248/88"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"id": "932281",
|
"id": "932281",
|
||||||
"name": "Remote Command Execution: Brace Expansion Found",
|
"name": "Remote Command Execution: Brace Expansion Found",
|
||||||
@@ -2676,7 +2296,7 @@
|
|||||||
"name": "CRS Cross-Site Scripting (XSS)",
|
"name": "CRS Cross-Site Scripting (XSS)",
|
||||||
"version": "4.24.0",
|
"version": "4.24.0",
|
||||||
"source": "owasp-crs",
|
"source": "owasp-crs",
|
||||||
"description": "OWASP CRS v4.24.0 — CRS Cross-Site Scripting (XSS) (31 rules)",
|
"description": "OWASP CRS v4.24.0 — CRS Cross-Site Scripting (XSS) (30 rules)",
|
||||||
"author": "OWASP CRS Project",
|
"author": "OWASP CRS Project",
|
||||||
"priority": 5,
|
"priority": 5,
|
||||||
"enabled": true,
|
"enabled": true,
|
||||||
@@ -3061,26 +2681,6 @@
|
|||||||
"capec/1000/152/242"
|
"capec/1000/152/242"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
|
||||||
"id": "941310",
|
|
||||||
"name": "US-ASCII Malformed Encoding XSS Filter - Attack Detected",
|
|
||||||
"pattern": "\\xbc[^\\xbe>]*[\\xbe>]|<[^\\xbe]*\\xbe",
|
|
||||||
"targets": [
|
|
||||||
"all"
|
|
||||||
],
|
|
||||||
"action": "block",
|
|
||||||
"score": 10,
|
|
||||||
"severity": "critical",
|
|
||||||
"category": "xss",
|
|
||||||
"enabled": true,
|
|
||||||
"tags": [
|
|
||||||
"attack-xss",
|
|
||||||
"paranoia-level/1",
|
|
||||||
"OWASP_CRS",
|
|
||||||
"OWASP_CRS/ATTACK-XSS",
|
|
||||||
"capec/1000/152/242"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"id": "941350",
|
"id": "941350",
|
||||||
"name": "UTF-7 Encoding IE XSS - Attack Detected",
|
"name": "UTF-7 Encoding IE XSS - Attack Detected",
|
||||||
@@ -3309,7 +2909,7 @@
|
|||||||
"name": "CRS SQL Injection (SQLi)",
|
"name": "CRS SQL Injection (SQLi)",
|
||||||
"version": "4.24.0",
|
"version": "4.24.0",
|
||||||
"source": "owasp-crs",
|
"source": "owasp-crs",
|
||||||
"description": "OWASP CRS v4.24.0 — CRS SQL Injection (SQLi) (60 rules)",
|
"description": "OWASP CRS v4.24.0 — CRS SQL Injection (SQLi) (56 rules)",
|
||||||
"author": "OWASP CRS Project",
|
"author": "OWASP CRS Project",
|
||||||
"priority": 3,
|
"priority": 3,
|
||||||
"enabled": true,
|
"enabled": true,
|
||||||
@@ -3734,48 +3334,6 @@
|
|||||||
"capec/1000/152/248/66"
|
"capec/1000/152/248/66"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
|
||||||
"id": "942130",
|
|
||||||
"name": "SQL Injection Attack: SQL Boolean-based attack detected",
|
|
||||||
"pattern": "(?i)[\\s\\x0b\"'-\\)`]*?\\b([0-9A-Z_a-z]+)\\b[\\s\\x0b\"'-\\)`]*?(?:=|<=>|(?:sounds[\\s\\x0b]+)?like|glob|r(?:like|egexp))[\\s\\x0b\"'-\\)`]*?\\b([0-9A-Z_a-z]+)\\b",
|
|
||||||
"targets": [
|
|
||||||
"body",
|
|
||||||
"query"
|
|
||||||
],
|
|
||||||
"action": "block",
|
|
||||||
"score": 10,
|
|
||||||
"severity": "critical",
|
|
||||||
"category": "sqli",
|
|
||||||
"enabled": true,
|
|
||||||
"tags": [
|
|
||||||
"attack-sqli",
|
|
||||||
"paranoia-level/2",
|
|
||||||
"OWASP_CRS",
|
|
||||||
"OWASP_CRS/ATTACK-SQLI",
|
|
||||||
"capec/1000/152/248/66"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"id": "942131",
|
|
||||||
"name": "SQL Injection Attack: SQL Boolean-based attack detected",
|
|
||||||
"pattern": "(?i)[\\s\\x0b\"'-\\)`]*?\\b([0-9A-Z_a-z]+)\\b[\\s\\x0b\"'-\\)`]*?(?:![<->]|<[=>]?|>=?|\\^|is[\\s\\x0b]+not|not[\\s\\x0b]+(?:like|r(?:like|egexp)))[\\s\\x0b\"'-\\)`]*?\\b([0-9A-Z_a-z]+)\\b",
|
|
||||||
"targets": [
|
|
||||||
"body",
|
|
||||||
"query"
|
|
||||||
],
|
|
||||||
"action": "block",
|
|
||||||
"score": 10,
|
|
||||||
"severity": "critical",
|
|
||||||
"category": "sqli",
|
|
||||||
"enabled": true,
|
|
||||||
"tags": [
|
|
||||||
"attack-sqli",
|
|
||||||
"paranoia-level/2",
|
|
||||||
"OWASP_CRS",
|
|
||||||
"OWASP_CRS/ATTACK-SQLI",
|
|
||||||
"capec/1000/152/248/66"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"id": "942150",
|
"id": "942150",
|
||||||
"name": "SQL Injection Attack: SQL function name detected",
|
"name": "SQL Injection Attack: SQL function name detected",
|
||||||
@@ -4157,26 +3715,6 @@
|
|||||||
"capec/1000/152/248/66"
|
"capec/1000/152/248/66"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
|
||||||
"id": "942440",
|
|
||||||
"name": "SQL Comment Sequence Detected",
|
|
||||||
"pattern": "/\\*!?|\\*/|[';]--|--(?:[\\s\\x0b]|[^\\-]*?-)|[^&\\-]#.*?[\\s\\x0b]|;?\\x00",
|
|
||||||
"targets": [
|
|
||||||
"all"
|
|
||||||
],
|
|
||||||
"action": "block",
|
|
||||||
"score": 10,
|
|
||||||
"severity": "critical",
|
|
||||||
"category": "sqli",
|
|
||||||
"enabled": true,
|
|
||||||
"tags": [
|
|
||||||
"attack-sqli",
|
|
||||||
"paranoia-level/2",
|
|
||||||
"OWASP_CRS",
|
|
||||||
"OWASP_CRS/ATTACK-SQLI",
|
|
||||||
"capec/1000/152/248/66"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"id": "942450",
|
"id": "942450",
|
||||||
"name": "SQL Bin or Hex Encoding Identified",
|
"name": "SQL Bin or Hex Encoding Identified",
|
||||||
@@ -4237,26 +3775,6 @@
|
|||||||
"capec/1000/152/248/66"
|
"capec/1000/152/248/66"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
|
||||||
"id": "942521",
|
|
||||||
"name": "Detects basic SQL authentication bypass attempts 4.1/4",
|
|
||||||
"pattern": "(?i)^(?:[^']*?(?:'[^']*?'[^']*?)*?'|[^\"]*?(?:\"[^\"]*?\"[^\"]*?)*?\"|[^`]*?(?:`[^`]*?`[^`]*?)*?`)[\\s\\x0b]*([0-9A-Z_a-z]+)\\b",
|
|
||||||
"targets": [
|
|
||||||
"all"
|
|
||||||
],
|
|
||||||
"action": "block",
|
|
||||||
"score": 10,
|
|
||||||
"severity": "critical",
|
|
||||||
"category": "sqli",
|
|
||||||
"enabled": true,
|
|
||||||
"tags": [
|
|
||||||
"attack-sqli",
|
|
||||||
"paranoia-level/2",
|
|
||||||
"OWASP_CRS",
|
|
||||||
"OWASP_CRS/ATTACK-SQLI",
|
|
||||||
"capec/1000/152/248/66"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"id": "942522",
|
"id": "942522",
|
||||||
"name": "Detects basic SQL authentication bypass attempts 4.1/4",
|
"name": "Detects basic SQL authentication bypass attempts 4.1/4",
|
||||||
@@ -4527,7 +4045,7 @@
|
|||||||
"name": "CRS Session Fixation",
|
"name": "CRS Session Fixation",
|
||||||
"version": "4.24.0",
|
"version": "4.24.0",
|
||||||
"source": "owasp-crs",
|
"source": "owasp-crs",
|
||||||
"description": "OWASP CRS v4.24.0 — CRS Session Fixation (3 rules)",
|
"description": "OWASP CRS v4.24.0 — CRS Session Fixation (1 rules)",
|
||||||
"author": "OWASP CRS Project",
|
"author": "OWASP CRS Project",
|
||||||
"priority": 10,
|
"priority": 10,
|
||||||
"enabled": true,
|
"enabled": true,
|
||||||
@@ -4551,46 +4069,6 @@
|
|||||||
"OWASP_CRS/ATTACK-SESSION-FIXATION",
|
"OWASP_CRS/ATTACK-SESSION-FIXATION",
|
||||||
"capec/1000/225/21/593/61"
|
"capec/1000/225/21/593/61"
|
||||||
]
|
]
|
||||||
},
|
|
||||||
{
|
|
||||||
"id": "943110",
|
|
||||||
"name": "Possible Session Fixation Attack: SessionID Parameter Name with Off-Domain Referer",
|
|
||||||
"pattern": "^(?:j(?:se(?:ssionid|rvsession)|wsession)|(?:asp(?:\\.net_)?session|zend_session_)id|p(?:hpsessi(?:on|d)|lay_session)|(?:(?:w(?:eblogic|l)|rack\\.|laravel_)sessio|(?:next-auth\\.session-|meteor_login_)toke)n|s(?:(?:ession[\\-_]?|ails\\.s)id|hiny-token)|_(?:session_id|(?:(?:flask|rails)_sessio|_(?:secure|host)-next-auth\\.session-toke)n)|c(?:f(?:s?id|token)|onnect\\.sid|akephp|i_session)|koa[\\.:]sess)$",
|
|
||||||
"targets": [
|
|
||||||
"query"
|
|
||||||
],
|
|
||||||
"action": "block",
|
|
||||||
"score": 10,
|
|
||||||
"severity": "critical",
|
|
||||||
"category": "session_fixation",
|
|
||||||
"enabled": true,
|
|
||||||
"tags": [
|
|
||||||
"attack-fixation",
|
|
||||||
"paranoia-level/1",
|
|
||||||
"OWASP_CRS",
|
|
||||||
"OWASP_CRS/ATTACK-SESSION-FIXATION",
|
|
||||||
"capec/1000/225/21/593/61"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"id": "943120",
|
|
||||||
"name": "Possible Session Fixation Attack: SessionID Parameter Name with No Referer",
|
|
||||||
"pattern": "^(?:jsessionid|aspsessionid|asp\\.net_sessionid|phpsession|phpsessid|weblogicsession|session_id|session-id|sessionid|cfid|cftoken|cfsid|jservsession|jwsession|_flask_session|_session_id|connect\\.sid|laravel_session)$",
|
|
||||||
"targets": [
|
|
||||||
"query"
|
|
||||||
],
|
|
||||||
"action": "block",
|
|
||||||
"score": 10,
|
|
||||||
"severity": "critical",
|
|
||||||
"category": "session_fixation",
|
|
||||||
"enabled": true,
|
|
||||||
"tags": [
|
|
||||||
"attack-fixation",
|
|
||||||
"paranoia-level/1",
|
|
||||||
"OWASP_CRS",
|
|
||||||
"OWASP_CRS/ATTACK-SESSION-FIXATION",
|
|
||||||
"capec/1000/225/21/593/61"
|
|
||||||
]
|
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
@@ -4599,7 +4077,7 @@
|
|||||||
"name": "CRS Java / Deserialization Attack",
|
"name": "CRS Java / Deserialization Attack",
|
||||||
"version": "4.24.0",
|
"version": "4.24.0",
|
||||||
"source": "owasp-crs",
|
"source": "owasp-crs",
|
||||||
"description": "OWASP CRS v4.24.0 — CRS Java / Deserialization Attack (13 rules)",
|
"description": "OWASP CRS v4.24.0 — CRS Java / Deserialization Attack (11 rules)",
|
||||||
"author": "OWASP CRS Project",
|
"author": "OWASP CRS Project",
|
||||||
"priority": 3,
|
"priority": 3,
|
||||||
"enabled": true,
|
"enabled": true,
|
||||||
@@ -4624,46 +4102,6 @@
|
|||||||
"capec/1000/152/137/6"
|
"capec/1000/152/137/6"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
|
||||||
"id": "944110",
|
|
||||||
"name": "Remote Command Execution: Java process spawn (CVE-2017-9805)",
|
|
||||||
"pattern": "(?:runtime|processbuilder)",
|
|
||||||
"targets": [
|
|
||||||
"all"
|
|
||||||
],
|
|
||||||
"action": "block",
|
|
||||||
"score": 10,
|
|
||||||
"severity": "critical",
|
|
||||||
"category": "deserialization",
|
|
||||||
"enabled": true,
|
|
||||||
"tags": [
|
|
||||||
"attack-rce",
|
|
||||||
"paranoia-level/1",
|
|
||||||
"OWASP_CRS",
|
|
||||||
"OWASP_CRS/ATTACK-JAVA",
|
|
||||||
"capec/1000/152/248"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"id": "944120",
|
|
||||||
"name": "Remote Command Execution: Java serialization (CVE-2015-4852)",
|
|
||||||
"pattern": "(?:clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder)",
|
|
||||||
"targets": [
|
|
||||||
"all"
|
|
||||||
],
|
|
||||||
"action": "block",
|
|
||||||
"score": 10,
|
|
||||||
"severity": "critical",
|
|
||||||
"category": "deserialization",
|
|
||||||
"enabled": true,
|
|
||||||
"tags": [
|
|
||||||
"attack-rce",
|
|
||||||
"paranoia-level/1",
|
|
||||||
"OWASP_CRS",
|
|
||||||
"OWASP_CRS/ATTACK-JAVA",
|
|
||||||
"capec/1000/152/248"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"id": "944140",
|
"id": "944140",
|
||||||
"name": "Java Injection Attack: Java Script File Upload Found",
|
"name": "Java Injection Attack: Java Script File Upload Found",
|
||||||
@@ -5379,7 +4817,7 @@
|
|||||||
"name": "CRS IIS Data Leakage",
|
"name": "CRS IIS Data Leakage",
|
||||||
"version": "4.24.0",
|
"version": "4.24.0",
|
||||||
"source": "owasp-crs",
|
"source": "owasp-crs",
|
||||||
"description": "OWASP CRS v4.24.0 — CRS IIS Data Leakage (4 rules)",
|
"description": "OWASP CRS v4.24.0 — CRS IIS Data Leakage (3 rules)",
|
||||||
"author": "OWASP CRS Project",
|
"author": "OWASP CRS Project",
|
||||||
"priority": 15,
|
"priority": 15,
|
||||||
"enabled": true,
|
"enabled": true,
|
||||||
@@ -5424,26 +4862,6 @@
|
|||||||
"capec/1000/118/116"
|
"capec/1000/118/116"
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
|
||||||
"id": "954130",
|
|
||||||
"name": "IIS Information Leakage",
|
|
||||||
"pattern": "^404$",
|
|
||||||
"targets": [
|
|
||||||
"body"
|
|
||||||
],
|
|
||||||
"action": "block",
|
|
||||||
"score": 8,
|
|
||||||
"severity": "high",
|
|
||||||
"category": "data_leakage",
|
|
||||||
"enabled": true,
|
|
||||||
"tags": [
|
|
||||||
"attack-disclosure",
|
|
||||||
"paranoia-level/1",
|
|
||||||
"OWASP_CRS",
|
|
||||||
"OWASP_CRS/DATA-LEAKAGES-IIS",
|
|
||||||
"capec/1000/118/116"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"id": "954101",
|
"id": "954101",
|
||||||
"name": "Disclosure of IIS install location",
|
"name": "Disclosure of IIS install location",
|
||||||
|
|||||||
Reference in new issue
Block a user