Atomicorp WAF Rule 340029

Rule Summary

• Rule ID: 340029
• Status: Active
• Alert message: Atomicorp.com WAF Rules: Attack Blocked - command in REQUEST_URI or Argument
• Observed CWEs: CWE-20 (14), CWE-22 (130), CWE-59 (1), CWE-73 (1), CWE-74 (18), CWE-77 (98), CWE-78 (229), CWE-79 (3), CWE-88 (2), CWE-89 (11), CWE-93 (1), CWE-94 (69), CWE-95 (6), CWE-120 (1), CWE-121 (3), CWE-183 (1), CWE-184 (2), CWE-187 (1), CWE-200 (3), CWE-253 (1), CWE-269 (4), CWE-284 (4), CWE-285 (1), CWE-287 (2), CWE-288 (1), CWE-306 (8), CWE-352 (4), CWE-434 (10), CWE-470 (3), CWE-494 (1), CWE-502 (1), CWE-611 (1), CWE-639 (1), CWE-641 (1), CWE-644 (1), CWE-698 (1), CWE-732 (1), CWE-791 (1), CWE-829 (2), CWE-835 (1), CWE-862 (5), CWE-863 (4), CWE-915 (1), CWE-918 (1), CWE-942 (1), CWE-1188 (1), CWE-1336 (5), CWE-1392 (1)
• Revision: 41
• Rule severity: Critical (2)
• Phase: 2 (request body)
• Request surfaces: Request URI, Request arguments, JSON request data, SOAP request data
• Rule action: deny
• HTTP status: 403
• Logging: log, auditlog

Description

This rule detects when a Linux command is used in a URL or an argument. It specifically looks for these types of commands:

• process management tools (kill, nice, etc.)
• file management tools (cp, chown, rm, etc.)
• shells (bash, tcsh, etc.)
• compilers (gcc, c++, etc.)
• web downloading tools (wget, curl, etc.)
• interpreters (perl, php, etc.)
• other downloading tools (scp, ftp, etc.)

Some attack tools are known to blindly look for software tools and to see if it can use them. Therefore, the fact that this rule is triggered does not mean that the software tool is installed on the system.

If your system is being targeted with these kinds of attacks we do not recommend you disable this rule. This rule may be telling you that someone is attacking your system, and therefore you should block this source. Please see the blog post referenced below for information about leaving rules enabled for applications you may not have installed.

Troubleshooting

False Positives

A false positive could occur if an application either safely allows the use of these tools, or if the data is used in a non-command context such as in a document. The rule contains a large number of known safe applications that may either use these tools securely, or may allow this data in non-command mode. If you have confirmed that your application is safely using these commands, or this data in a non-command format, please let us know what the application is, how you confirmed this so we can duplicate this in our test environment, and report the issue as a False Positive per the article below:

Tuning Guidance

If you want to disable this rule, please see the Tuning the Atomicorp WAF Rules page for basic information.

Additional Information

Blog Articles

None.

Selected Related CVEs

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

Observed CWEs

These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.

Documentation Source

• Original wiki page: WAF 340029
• Source revision: 4329
• Source revision date: 2013-12-12