On this page

Atomicorp WAF Rule 340617

Rule Summary

  • Rule ID: 340617
  • Status: Active
  • Alert message: Atomicorp.com WAF Rules: Remote File Injection attempt in ARGS
  • Observed CWEs: None documented
  • Revision: 1
  • Rule severity: Critical (2)
  • Phase: 2 (request body)
  • Request surfaces: Request arguments, JSON request data, SOAP request data
  • Rule action: deny
  • HTTP status: 403
  • Logging: log, auditlog

Description

GET and HEAD requests can not have bodies. This rule detects an attempt to include a body with these methods and can be part of attempt to attack your system by hiding or smuggling content in a non-standard method.

False Positives

There are no known False Positives for this. This method is also invalid HTTP and should not be allowed.

If you do believe this is a false positive, it recommended that you report this to our security team so they can determine if this is a legitimate case, or if its clever attack on your systems. Instructions to report false positives are detailed on the Reporting False Positives wiki page.

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

No selected related public CVE research notes are currently published.

Documentation Source

  • Original wiki page: WAF 340617
  • Source revision: 678
  • Source revision date: 2009-11-25