On this page

Atomicorp WAF Rule 330773

Rule Summary

  • Rule ID: 330773
  • Status: Active
  • Alert message: Atomicorp.com WAF Rules: client redefining HTTP_PROXY value denied
  • Observed CWEs: None documented
  • Revision: 2
  • Rule severity: Warning (4)
  • Phase: 2 (request body)
  • Request surfaces: Request headers
  • Rule action: deny
  • HTTP status: 403
  • Logging: log, auditlog

Description

This means the client tried to set an HTTP header called “Proxy”. This header is not defined, and causes what is called a namespace conflict. Web servers take this header and convert it to HTTP_PROXY. Which a web application will treat as the Proxy address for the web application. This allows a user to define the Proxy value for a web application, thereby forcing and control the web application to send any outbound traffic to a server of the users choice. An attacker can use this carry out man in the middle attacks on the application, allowing the attacker to send and recieve any data from/to the web application, potentially leading to code injections into the web application and compromise of the system.

This rule blocks attempts to define this value.

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

No selected related public CVE research notes are currently published.

Documentation Source

  • Original wiki page: WAF 330773
  • Source revision: 5744
  • Source revision date: 2016-07-18