Atomicorp WAF Rule 340149

Rule Summary

• Rule ID: 340149
• Status: Active
• Alert message: Atomicorp.com WAF Rules: Potential Cross Site Scripting Attack
• Observed CWEs: CWE-20 (2), CWE-73 (1), CWE-74 (1), CWE-77 (1), CWE-78 (3), CWE-79 (34), CWE-80 (1), CWE-89 (3), CWE-94 (1), CWE-119 (1), CWE-200 (2), CWE-264 (1), CWE-287 (2), CWE-295 (2), CWE-306 (1), CWE-352 (3), CWE-610 (1), CWE-611 (1), CWE-862 (1)
• Revision: 162
• Rule severity: Critical (2)
• Phase: 2 (request body)
• Request surfaces: Request headers, Request argument names, Request arguments, JSON request data, SOAP request data
• Rule action: deny
• HTTP status: 403
• Logging: log, auditlog

Description

This rules detects when a potential cross site scripting attack may have occurred. For example, if javascript is included in a variable that appears to not be used for this purpose, or if web code is included in a portion of a request that is not known to be used for this purpose. This rule looks for encoded methods.

Troubleshooting

False Positives

This rule may produce a false positive if an application is used in a previously unknown or untested manner. The rules contain a large library of known trusted methods, however it is possible an application may be using a previously untested method. It is not recommended that you disable this rule if you have a false positive. If you believe this is a false positive, please report this to our security team to determine if this is a legitimate case, or if its clever attack on your system. Instructions to report false positives are detailed on the Reporting False Positives wiki page. If it is a false positive, we will fix the issue in the rules and get a release out to you promptly.

Tuning Guidance

See the Mod_security page for guidance on tuning this rule.

Additional Information

Similar Rules

WAF 340148

WAF 340147

Selected Related CVEs

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

Observed CWEs

These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.

Documentation Source

• Original wiki page: WAF 340149
• Source revision: 3077
• Source revision date: 2013-01-03