On this page

Atomicorp WAF Rule 332039

Rule Summary

  • Rule ID: 332039
  • Status: Active
  • Alert message: Atomicorp.com WAF Rules: Suspicious Unusual User Agent (python-requests). Disable this rule if you use python-requests/.
  • Observed CWEs: None documented
  • Revision: 4
  • Rule severity: Critical (2)
  • Phase: 2 (request body)
  • Rule action: deny
  • HTTP status: 403
  • Logging: log, auditlog

Description

This rule detects when a client tells the web server that it is the python-requests library. Web clients can report to a web server what they are. For example, a web client can report to the web server that it is a Webbrowser, such as Chrome, or it can report to the web server that it is GoogleBot, or a specific client, library or software package. Clients do this by sending a special header to the web server, for example:

User-Agent: python-requests/2.2.1 CPython/2.7.6 Linux/3.19.0-25-generic

Some malware is known to use the python-requests library, so some users prefer to block all requests with this User-agent header. Some PCI-DSS compliance auditors will fail a site if it does not block clients that self report this client.

False Positives'

None. The rule does not cause this to occur, it can only be triggered if the Client reports it is using this software package. Therefore, if you wish to allow these clients to connect to your system, simply disable the rule.

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

No selected related public CVE research notes are currently published.

Documentation Source

  • Original wiki page: WAF 332039
  • Source revision: 5607
  • Source revision date: 2015-12-07