edgeguard-owasp-feed/CVE-CHANNEL.md

# The CVE channel (`cve.json`)

This document carries virtual patches: rules written against a named
vulnerability, published as data so that every edge node enforces them within
the hour instead of waiting for an engine release.

It is deliberately a second document in this repository, not a second
repository and not part of `rulesets.json`. Each has its own `build_datetime`,
so each is skipped or applied on its own, and a mistake in one cannot take out
the other.

Engine 3.0.47 and later fetch it hourly from:

    https://git.artica.center/Andre/edgeguard-owasp-feed/raw/branch/main/cve.json

## Rehearsing a rule before it reaches anybody

Since engine 3.2.7 an installation can point the channel at its own document:

```json
{ "ruleset_feeds": { "enabled": true, "cve_url": "https://your.host/cve.json" } }
```

It **replaces** the published channel rather than adding to it, because the
channel owns its ruleset source: a fetch clears that source before rebuilding
it, which is what makes a rule withdrawable, and two feeds claiming it would
delete each other's rules on alternating ticks. `rulesets_url` does the same
for the CRS mirror. Leave both empty for the published documents, which is the
right default — an installation that sets nothing gets the patches we publish.

So the sequence for a new patch is: publish it to your own document, let it run
as `log` against your own traffic for as long as it takes to trust, and only
then propose it here. Until this existed there was nowhere to do that, and
every publish was a decision taken on every customer's behalf with no
rehearsal.

## When a rule belongs here, and when it does not

This document reaches every customer's agents from one hardcoded URL, so a
publish is a decision taken on their behalf. It earns that only in a narrow
case: **an actively exploited vulnerability, recognisable in a single request,
in software customers run, during the days before a real fix exists.** That is
a few a year.

Entry and exit, so rules do not accumulate because publishing is easy:

1. **In as `log`.** It records matches and scores nothing, so it refuses
   nothing while you see what it would have caught.
2. **Promoted to `critical` only with a reason.** Severity is what acts —
   `high` scores 4 against a default threshold of 5 and does nothing on its
   own. A rule left at `high` is inert, not cautious.
3. **Then out.** Anything still worth enforcing after the emergency moves into
   the engine, where it works with no network and cannot be withdrawn by a bad
   publish — Log4Shell, Spring4Shell and PHP2Shell all live there. Anything no
   longer worth it is deleted and the stamp bumped.

A rule sitting here indefinitely is in the wrong place.

**And customers do not need this channel for their own rules.** Create Custom
Ruleset in the console takes the same fields and reaches their agents through
the configuration pull, scoped to the sites they choose. The config pull is
forbidden from touching the sources this feed owns and this feed is forbidden
from touching theirs, so the two cannot clear each other.

## Publishing a patch

Add a rule to the single ruleset, bump `build_datetime`, commit, push. An
unchanged `build_datetime` means every node skips the document without reading
it, so the stamp is what makes a publish take effect.

```json
{
  "build_datetime": "2026-10-22T13:00:00Z",
  "rulesets": [{
    "id": "edgeguard-cve",
    "name": "EdgeGuard CVE Virtual Patches",
    "version": "1",
    "source": "edgeguard-cve",
    "description": "Virtual patches for named vulnerabilities",
    "enabled": true,
    "priority": 1,
    "rules": [{
      "id": "CVE-2025-31161-01",
      "name": "CrushFTP authentication bypass via crafted Authorization header",
      "pattern": "(?i)AWS4-HMAC-SHA256.*Credential=[^/]*/",
      "targets": ["headers"],
      "action": "block",
      "severity": "critical",
      "category": "cve",
      "cve": "CVE-2025-31161",
      "enabled": true,
      "references": ["https://nvd.nist.gov/vuln/detail/CVE-2025-31161"]
    }]
  }]
}
```

That example is deliberately NOT the PHP upload-progress rule, which this
document used to show. That CVE is patched in compiled code, so the guard below
refuses it — the one example a reader was most likely to copy was the one
example that could not be published. Anything already patched in code belongs
in code; see the end of this page.

`source` must be `edgeguard-cve`. That is the source the channel owns and the
only one it may clear, which is also what makes a rule **withdrawable**: remove
it, bump the stamp, and it stops being enforced everywhere within the hour.
Publishing an empty `"rulesets": []` withdraws the lot.


## Importing from a Nuclei template

A CVE record describes a vulnerability, not a request, which is why this
channel is written by hand. A **Nuclei template** does contain the request —
path, query, headers, body — because that is what it sends. So for thousands of
CVEs the shape a virtual patch needs is already written down.

    go run ./tools/nuclei-importer -cves CVE-2025-31161,CVE-2024-4577 \
        -merge edgeguard-rules/cve.json > /tmp/next.json
    cp /tmp/next.json edgeguard-rules/cve.json
    bash tools/publish-cve-feed.sh --check

**Imported rules land as `action: "log"`, and that is not timidity.** A template
decides whether a target was actually vulnerable by reading the RESPONSE —
words in the body, the content type, the status. A WAF decides before a
response exists, so the imported rule is strictly weaker than the template it
came from: the template confirms exploitation, the rule only recognises the
attempt. Watch what it would have caught in your own traffic, then change
`log` to `block` deliberately, per rule.

Each imported rule carries an `origin` field saying a human did not write its
pattern and what it came from. Do not remove it — it is the difference between
a rule somebody reasoned about and one a converter guessed.

### What it refuses to do

It skips rather than guesses, and prints why:

- **A CVE the engine already patches in code.** Both rules would fire and the
  scores would add. Five are patched today: the two PHP2Shell ones, Log4Shell
  (two) and Spring4Shell.
- **A request with nothing literal in it.** Templates are full of
  `{{BaseURL}}` and `{{string_1}}`; a pattern that is mostly `.*` matches
  ordinary traffic.
- **A request whose longest literal is under twelve characters**, or is the
  site root. A rule on `/` matches everything.

### What it corrects, and why you should check anyway

It strips one leading path segment when three remain, because a template is
written against a laboratory where the application is mounted somewhere: the
phpunit template requests `/laravel52/vendor/phpunit/...` and `laravel52` is
that lab's directory. Without stripping it the rule is published, enabled, and
unable to match a real attack at `/vendor/phpunit/...`.

It prefers a header value carrying an injection marker (`${jndi:`, `<%`, `$(`,
`../`) over a path, and ignores standard headers entirely whatever their value.
An earlier version preferred headers over everything and produced the pattern
`Content-Type: text/html` for a PHP RCE — a rule that says nothing about the
attack and something about every request.

None of that makes the output right. Read every pattern before publishing.

## Targets

The usual ones (`uri`, `query`, `args`, `body`, `headers`, `user_agent`,
`cookies`, `filename`, `all`) plus:

- **`param_names`** — the pattern is run against each parameter NAME on its
  own: query parameters, urlencoded body fields and multipart
  `Content-Disposition` names. An anchored pattern therefore anchors to one
  name, and a parameter whose *value* happens to be the string can never match.
  This is the shape CVE-2026-109618 needed and the reason it could not be
  written against `args`, where names and values arrive as one blob and
  `?note=PHP_SESSION_UPLOAD_PROGRESS` would have been refused.

Write `param_names` patterns in lower case; both the original and the
lowercased spelling of each name are tried.

## Severity is the score

`critical` 5, `high` 4, `medium` 3, `low` 2, against a default anomaly
threshold of 5. A patch that should refuse on its own is `critical`; one that
should only contribute is `medium` or below. Nothing else sets the score.

## Two things to get right

**Do not publish a rule for a CVE the engine already patches in code.** Both
would fire on the same request, the anomaly score would be the sum, and the
event would report one attack as two rules.
`TestPublishedFeedDoesNotDuplicateACompiledRule` in the engine fails if this
document names a CVE that `ruleCVEReferences` already covers.

**A patch written in the hours after a disclosure is written against an
advisory, not against traffic.** There is no backtest. If one turns out to
refuse something real, the remedy is to withdraw it — which is why withdrawal
is a first-class operation here.