On this page

Atomicorp WAF Rule 301311

Rule Summary

  • Rule ID: 301311
  • Status: Active
  • Alert message: Atomicorp.com WAF AntiSpam Rules: Spam: Session Splitting Spam Attempt
  • Observed CWEs: None documented
  • Revision: 2
  • Rule severity: Warning (4)
  • Phase: 2 (request body)
  • Request surfaces: Request URI
  • Rule action: deny
  • HTTP status: 403
  • Logging: log, auditlog

Description

This rules detects when a client attempts, and fails to issue what is sometimes referred to as a “session splitting” attack. This type of attack attempts to trick the web server into thinking its serving one request, when its serving another. This attack method is also used to try and trick a WAF into not looking at the second, or “real” request which includes the real payload and attack.

This particular rule catches a method that spammers use to try and post spam to a website, and sometimes to register with a forum, blog, CMS or other web application that requires registration.

Troubleshooting

False Positives

None. This rule only detects completely invalid requests, there is no known legitmiate action that would trigger this rule.

Tuning Guidance

None.

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

No selected related public CVE research notes are currently published.

Documentation Source

  • Original wiki page: WAF 301311
  • Source revision: 2827
  • Source revision date: 2012-10-28