On this page

Atomicorp WAF Rule 340001

Rule Summary

  • Rule ID: 340001
  • Status: Active
  • Alert message: Atomicorp.com WAF Rules - Virtual Just In Time Patch: Solarwinds backdoor attempt
  • Observed CWEs: None documented
  • Revision: 1
  • Rule severity: Critical (2)
  • Phase: 2 (request body)
  • Request surfaces: Request URI
  • Rule action: deny
  • HTTP status: 403
  • Logging: log, auditlog

Description

modsecurity, the WAF used, does not support Transfer Encoding, therefore it can not see or evaluate any traffic encoded in this manner. If an attack were to be encoded in this way the WAF would not catch it, therefore the WAF is configured to block this traffic.

False Positives

None. This does not have any known false positives. If it triggers it means Transfer Encoding is being used. If you allow Transfer Encoding by disabling this rule you will open your system up to attacks that ASL can not detect or prevent.

Similar Rules

WAF_340362

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

No selected related public CVE research notes are currently published.

Documentation Source

  • Original wiki page: WAF 340001
  • Source revision: 2319
  • Source revision date: 2012-05-16