Atomicorp WAF Rule 330791

Rule Summary

• Rule ID: 330791
• Status: Active
• Alert message: Failed to parse request body. This may be an impedence mismatch attack, a broken application or a broken connection. This is not a false positive. Check your application or client for errors.
• Observed CWEs: CWE-20 (2), CWE-22 (6), CWE-27 (1), CWE-74 (1), CWE-77 (1), CWE-78 (9), CWE-79 (13), CWE-89 (6), CWE-94 (3), CWE-98 (1), CWE-200 (6), CWE-209 (1), CWE-255 (2), CWE-264 (4), CWE-285 (1), CWE-287 (2), CWE-288 (1), CWE-306 (3), CWE-352 (2), CWE-362 (1), CWE-416 (1), CWE-434 (9), CWE-502 (1), CWE-534 (1), CWE-611 (10), CWE-732 (1), CWE-829 (1), CWE-862 (2), CWE-863 (2), CWE-917 (1), CWE-918 (1), CWE-1336 (1)
• Revision: 3
• Rule severity: Critical (2)
• Phase: 2 (request body)
• Rule action: deny
• HTTP status: 400
• Public tags: no_ar
• Logging: log, auditlog

Description

This rule detects when the request body processor, used for request body parsing, is unable to parse the body of the request. This is a serious condition, and can mean only one of two things:

1) An attacker is attempting to bypass the WAF by constructing a body that will not be parsed correctly by the WAF, in hopes of bypassing the WAF.

2) The client side application and/or server side application is generating a non-RFC compliant, or broken message body that the WAF is unable to assemble. This can occur with a broken application, broken client, buggy library or even a temporary broken connection.

False Positives

Disabling this rule will leave your system open for impedance mismatch attacks, therefore it is highly recommended you first discuss this issue with the applications developers to determine why the format of the request is unparsable, and determine if they can fix their application first. This condition is extremely rare and is almost always caused by a buggy application on the clients side. It is not recommended that you disable this rule if you have a false positive.

If you believe this is a false positive, please report this to our security team to determine if this is a legitimate case or if its clever attack on your system. If you know this is not an attack, please provide any and all information the application developer provided that shows the request is compliant and that there is not a bug on the client side.

Instructions to report false positives are detailed on the Reporting False Positives wiki page. If it is a false positive, we will fix the issue in the rules and get a release out to you promptly.

Tuning Guidance

If you know that this behaviour is acceptable for your application, you can tune it by identifying the application that is being triggered, and specifically allowing that application to generate bodies the WAF can not examine correctly. Please see the Tuning the Atomicorp WAF Rules page for basic information.

Similar Rules

WAF_330792

Selected Related CVEs

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

Observed CWEs

These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.

Documentation Source

• Original wiki page: WAF 330791
• Source revision: 2378
• Source revision date: 2012-06-15