On this page

Atomicorp WAF Rule 340012

Rule Summary

  • Rule ID: 340012
  • Status: Active
  • Alert message: Atomicorp.com WAF Rules: Unauthorized Proxy access attempt
  • Observed CWEs: None documented
  • Revision: 3
  • Rule severity: Critical (2)
  • Phase: 2 (request body)
  • Request surfaces: Raw request URI
  • Rule action: deny
  • Logging: log, auditlog

Description

This rule detects any attempt to use the web server as a proxy. For example, if a client attempts to send a request similar to this:

POST HTTP/1.0

This is an attempt to use the webserver to contect to an SMTP server. This method (and others) are used by hackers and spammers to carry out attacks and spamming activities through “marks” or systems that are vulnerable to proxying. This deflects the blame for the attack and spamming onto the system that is acting as a proxy.

This rule prevents unauthorized proxy attempts.

False Positives

There are no known false positives for this rule. If this rule is being triggered, a client is attempting to proxy a connection through the server.

Tuning Guidance

If you know that this behavior is acceptable for your application, you can tune it by following the Tuning the Atomicorp WAF Rules guidance.

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

No selected related public CVE research notes are currently published.

Documentation Source

  • Original wiki page: WAF 340012
  • Source revision: 1938
  • Source revision date: 2011-10-06