On this page

Atomicorp WAF Rule 330045

Rule Summary

  • Rule ID: 330045
  • Status: Active
  • Alert message: Atomicorp.com WAF Rules: Suspicious Unusual User Agent (pycurl). Disable this rule if you use pycurl.
  • Observed CWEs: None documented
  • Revision: 3
  • Rule severity: Critical (2)
  • Phase: 2 (request body)
  • Rule action: deny
  • HTTP status: 403
  • Logging: log, auditlog

Description

This rule is triggered if the user agent used to connect to the system is pycurl. Some PCI-DSS scanners will report a vulnerability if the system does not block all requests from this client.

False Positives

This client may already be used by some legitimate scripts and therefore this may not be an attack. If you use pycurl you must disable this rule.

False positives are not really possible with this rule. The rule simply alerts if the client reports itself as pycurl. If this is in error, please check your application.

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

No selected related public CVE research notes are currently published.

Documentation Source

  • Original wiki page: WAF 330045
  • Source revision: 2238
  • Source revision date: 2012-03-18