Rule 932180 "Restricted File Upload Attempt" targets filename, scores 10 and
blocks. Its pattern carries CRS's OS-pseudo-file list with no path anchor, so
bare words matched any uploaded filename:
module modules meminfo mounts misc mdstat mtrr loadavg locks version
uptime cmdline stat swaps slabinfo partitions pagetypeinfo
So release-version-2.zip, company-misc-notes.pdf and meminfo.txt were refused
as critical RCE attempts. Found because it blocked an image upload to our own
wiki, which sits behind EdgeGuard: the response carried x-edgeguard-id, the
console found the event by that id, and the match was `module-` in the
filename.
These names mean something as a PATH and nothing as a filename, so the branch
now requires a leading slash. The dotfile branch keeps its own (?:\b|^) anchor
and is untouched.
Measured against the previous pattern over a corpus of 51 names: 16 ordinary
filenames released, NOTHING newly blocked, and every true positive still
caught — .htaccess, .env, .aws/credentials, wp-config.php, /proc/version,
/proc/self/environ, ../../proc/modules, uploads/../../proc/kcore.
build_datetime bumped. An agent skips a feed whose stamp has not changed
without reading it, so a corrected pattern under the old stamp would reach
nobody.
Andre
Andre