On this page
Atomicorp WAF Rule 337207
Rule Summary
- Rule ID: 337207
- Status: Active
- Alert message: Atomicorp.com WAF Rules - Virtual Just In Time Patch: Java RCE attack blocked
- Observed CWEs: CWE-20 (2), CWE-94 (1)
- Revision: 4
- Rule severity: Critical (2)
- Phase: 2 (request body)
- Request surfaces: Request URI
- Rule action: deny
- HTTP status: 403
- Logging: log, auditlog
Description
This rule detects behavior identified by its current alert as “Virtual Just In Time Patch: Java RCE attack blocked” in the request URI. It evaluates during the request body phase and denies matching traffic with HTTP status 403.
Selected Related CVEs
This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.
| CVE | Vulnerability | Product | CVSS | Severity |
|---|---|---|---|---|
| CVE-2017-12611 | Apache Struts2 S2-053 - Remote Code Execution | struts | 9.8 (v3.0) | Critical |
| CVE-2017-9791 | Apache Struts2 S2-053 - Remote Code Execution | struts | 9.8 (v3.1) | Critical |
| CVE-2013-1965 | Apache Struts2 S2-012 RCE | struts | 9.3 (v2.0) | High |
| CVE-2007-4556 | OpenSymphony XWork/Apache Struts2 - Remote Code Execution | xwork | 6.8 (v2.0) | Medium |
| CVE-2012-0392 | Apache Struts2 S2-008 RCE | struts | 6.8 (v2.0) | Medium |
Observed CWEs
These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.
| CWE | Related Published CVEs |
|---|---|
| CWE-20 | CVE-2017-12611 , CVE-2017-9791 |
| CWE-94 | CVE-2013-1965 |