On this page

Atomicorp WAF Rule 340009

Rule Summary

  • Rule ID: 340009
  • Status: Active
  • Alert message: Atomicorp.com WAF Rules: Protected Path Access denied in URI/ARGS
  • Observed CWEs: None documented
  • Revision: 68
  • Rule severity: Critical (2)
  • Phase: 2 (request body)
  • Request surfaces: Request URI, Request headers, Request arguments, JSON request data, SOAP request data
  • Rule action: deny
  • HTTP status: 403
  • Logging: log, auditlog

Description

This rule detects if a protected path is accessed by a web request. A protected path includes key parts of the operating system, such as c:/windows, /bin, /lib, /dev, /proc and other important parts of the OS.

False Positives

If a web application needs to access these parts of the OS this rule can be triggered. Check to ensure that your application actually needs to access this part of the OS and that this is not an attack. It is not recommended you disable this rule, but rather that you report it as a false positive so we can put out an update for your application.

Instructions to report false positives are detailed on the Reporting False Positives wiki page.

If you wish to tune this rule yourself, please see the Tuning the Atomicorp WAF Rules page for basic information.

Similar Rules

WAF_340007

WAF_340006

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

No selected related public CVE research notes are currently published.

Documentation Source

  • Original wiki page: WAF 340009
  • Source revision: 709
  • Source revision date: 2009-11-26