On this page

Atomicorp WAF Rule 330700

Rule Summary

  • Rule ID: 330700
  • Status: Active
  • Alert message: Atomicorp.com WAF Rules: Invalid HTTP Request Line in violation of RFC (if you do not wish to follow HTTP RFCs, disable this rule)
  • Observed CWEs: None documented
  • Revision: 2
  • Rule severity: Warning (4)
  • Phase: 2 (request body)
  • Rule action: deny
  • HTTP status: 403
  • Logging: log, auditlog

Description

This rule is triggered if a client sends a completely invalid request line. Request lines are defined in RFC 2616 .

This is an example request line that would be invalid per the RFC:

GET ????????????foo/bar HTTP/1.1

Request lines must start with a “slash” (/). So this request would be invalid, per the RFC.

This technique may be used by attackers to attempt to evade web application firewalls and application security logic to compromise a system.

False Positives

False Positive can occur if a web client sends invalid requests or if an application is designed to work in a manner that is not-RFC compliant. The later is not known to occur, as web browsers will generally not accept grossly invalid requests.

If you believe this is a false positive, please report this to our security team to determine if this is a legitimate case, or if its clever attack on your system. Instructions to report false positives are detailed on the Reporting False Positives wiki page.

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

No selected related public CVE research notes are currently published.

Documentation Source

  • Original wiki page: WAF 330700
  • Source revision: 1066
  • Source revision date: 2010-10-29