On this page
Atomicorp WAF Rule 344362
Rule Summary
- Rule ID: 344362
- Status: Active
- Alert message: Atomicorp.com WAF Rules: Remote Command Execution: Unix Command Injection (2-3 chars)
- Observed CWEs: CWE-20 (7), CWE-22 (3), CWE-73 (1), CWE-74 (6), CWE-77 (3), CWE-78 (12), CWE-79 (2), CWE-88 (1), CWE-89 (10), CWE-94 (5), CWE-96 (1), CWE-158 (1), CWE-200 (1), CWE-209 (1), CWE-284 (3), CWE-287 (3), CWE-305 (1), CWE-306 (2), CWE-352 (3), CWE-434 (2), CWE-502 (29), CWE-532 (1), CWE-798 (1), CWE-836 (1), CWE-862 (1), CWE-917 (1), CWE-918 (6), CWE-1321 (1)
- Revision: 2
- Rule severity: Critical (2)
- Phase: 2 (request body)
- Request surfaces: Request cookies, Request argument names, Request arguments, JSON request data, SOAP request data, XML request data
- Rule action: deny
- HTTP status: 403
- Logging: log, auditlog
Description
This rule detects behavior identified by its current alert as “Remote Command Execution: Unix Command Injection (2-3 chars)” in the request cookies, request argument names, request arguments, JSON request data, SOAP request data, XML request data. It evaluates during the request body phase and denies matching traffic with HTTP status 403.
Selected Related CVEs
This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.
| CVE | Vulnerability | Product | CVSS | Severity |
|---|---|---|---|---|
| CVE-2009-1977 | Oracle Secure Backup Authentication Bypass/Command Injection Vulnerability | secure backup | 10.0 (v2.0) | High |
| CVE-2019-16932 | Visualizer <3.3.1 - Blind Server-Side Request Forgery | visualizer | 10.0 (v3.1) | Critical |
| CVE-2025-47812 | Wing FTP Server NULL-byte Authentication Bypass (CVE-2025-47812) | wing ftp server | 10.0 (v3.1) | Critical |
| CVE-2026-34234 | CtrlPanel <= 1.1.1 - Remote Code Execution | ctrlpanel | 10.0 (v3.1) | Critical |
| CVE-2026-44182 | Jupyter Enterprise Gateway Has Kubernetes Manifest Injection via Jinja2 Template Rendering | enterprise gateway | 10.0 (v4.0) | Critical |
| CVE-2026-45829 | ChromaDB Security Vulnerability | ChromaDB | 10.0 (v4.0) | Critical |
| CVE-2026-8985 | Unauthenticated Command Injection | maxicharger single charger firmware | 10.0 (v4.0) | Critical |
| CVE-2026-34838 | Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in AbstractSettingsCollection | group-office | 9.9 (v3.1) | Critical |
| CVE-2013-2251 | Apache Struts 2 DefaultActionMapper Prefixes OGNL Code Execution | archiva | 9.8 (v3.1) | Critical |
| CVE-2016-20017 | D-Link DSL-2750B OS Command Injection | dsl-2750b firmware | 9.8 (v3.1) | Critical |
| CVE-2017-12611 | Apache Struts2 S2-053 - Remote Code Execution | struts | 9.8 (v3.0) | Critical |
| CVE-2018-17431 | Comodo Unified Threat Management Web Console - Remote Code Execution | unified threat management firewall | 9.8 (v3.1) | Critical |
| CVE-2019-0230 | Apache Struts 2 Forced Multi OGNL Evaluation | struts | 9.8 (v3.1) | Critical |
| CVE-2019-17508 | DIR-850L (Un)authenticated OS Command Exec | dir-859 a3 firmware | 9.8 (v3.1) | Critical |
| CVE-2019-1935 | Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities | integrated management controller supervisor | 9.8 (v3.1) | Critical |
| CVE-2019-1937 | Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities | integrated management controller supervisor | 9.8 (v3.0) | Critical |
| CVE-2019-5434 | Revive Adserver 4.2 - Remote Code Execution | revive adserver | 9.8 (v3.0) | Critical |
| CVE-2020-14750 | Oracle WebLogic Server Administration Console Handle RCE | weblogic server | 9.8 (v3.1) | Critical |
| CVE-2020-14882 | Oracle WebLogic Server Administration Console Handle RCE | weblogic server | 9.8 (v3.1) | Critical |
| CVE-2020-17530 | Struts2 S2-061 Remote Code Execution Vulnerablity (CVE-2020-17530) | struts | 9.8 (v3.1) | Critical |
| CVE-2021-22175 | GitLab CI Lint API - Server-Side Request Forgery | gitlab | 9.8 (v3.1) | Critical |
| CVE-2021-42237 | Sitecore Experience Platform (XP) PreAuth Deserialization RCE | experience platform | 9.8 (v3.1) | Critical |
| CVE-2022-31181 | PrestaShop - SQL Injection to Eval Injection | prestashop | 9.8 (v3.1) | Critical |
| CVE-2023-23333 | SolarView Compact unauthenticated remote command execution vulnerability. | solarview compact firmware | 9.8 (v3.1) | Critical |
| CVE-2023-34124 | Sonicwall | analytics | 9.8 (v3.1) | Critical |
| CVE-2023-34132 | Sonicwall | analytics | 9.8 (v3.1) | Critical |
| CVE-2023-38646 | Metabase Pre-Auth JDBC Remote Code Execution (CVE-2023-38646) | metabase | 9.8 (v3.1) | Critical |
| CVE-2023-40504 | LG Simple Editor Command Injection (CVE-2023-40504) | simple editor | 9.8 (v3.1) | Critical |
| CVE-2024-0986 | Issabel Authenticated - Remote Code Execution | pbx | 9.8 (v3.1) | Critical |
| CVE-2024-27348 | Apache HugeGraph Unauthenticated Remote Code Execution (CVE-2024-27348) | hugegraph | 9.8 (v3.1) | Critical |
| CVE-2024-6670 | WhatsUp Gold SQL Injection (CVE-2024-6670) | whatsup gold | 9.8 (v3.1) | Critical |
| CVE-2024-6671 | WhatsUp Gold GetStatisticalMonitorList SQL Injection - Authentication Bypass | whatsup gold | 9.8 (v3.1) | Critical |
| CVE-2025-66455 | LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/con | lmdeploy | 9.8 (v3.1) | Critical |
| CVE-2026-115806 | Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Repla | Prime Mover – Backup and Migration | 9.8 (v3.1) | Critical |
| CVE-2026-19912 | Kaltura HTML5 Video Player, html5 library Arbitrary Code Execution Vulnerability | Kaltura HTML5 Video Player, html5 library | 9.8 (v3.1) | Critical |
| CVE-2026-22778 | vLLM Multimodal Heap-Address Information Leak Scanner | vllm | 9.8 (v3.1) | Critical |
| CVE-2026-8986 | Command Injection via Malicious OCPP Server | maxicharger single charger firmware | 9.5 (v4.0) | Critical |
| CVE-2025-34292 | BeWelcome/Rox PHP Object Injection RCE | Rox | 9.4 (v4.0) | Critical |
| CVE-2026-42596 | Gotenberg < 8.31.0 - Server-Side Request Forgery | gotenberg | 9.4 (v3.1) | Critical |
| CVE-2013-2642 | Sophos Web Protection Appliance 3.7.8.1 - Multiple Vulnerabilities | web appliance firmware | 9.3 (v2.0) | High |
| CVE-2023-54398 | Yonyou U8 Cloud Java Deserialization RCE via FileManageServlet | U8 Cloud | 9.3 (v4.0) | Critical |
| CVE-2025-66571 | UNA CMS 9.0.0-RC1 - 14.0.0-RC4 PHP Object Injection | UNA CMS versions 9.0.0-RC1 - 14.0.0-RC4 | 9.3 (v4.0) | Critical |
| CVE-2026-28515 | openDCIM install.php SQL Injection to RCE | opendcim | 9.3 (v4.0) | Critical |
| CVE-2026-28516 | openDCIM install.php SQL Injection to RCE | opendcim | 9.3 (v4.0) | Critical |
| CVE-2026-28517 | openDCIM install.php SQL Injection to RCE | opendcim | 9.3 (v4.0) | Critical |
| CVE-2026-10042 | manga-image-translator RCE via Unsafe Pickle Deserialization in Share Model | manga-image-translator | 9.2 (v4.0) | Critical |
| CVE-2026-87930 | MaxSite CMS through 109.6 PHP Object Injection via ci_session | MaxSite CMS | 9.2 (v4.0) | Critical |
| CVE-2014-7236 | TWiki Debugenableplugins Remote Code Execution | twiki | 9.1 (v3.1) | Critical |
| CVE-2023-36934 | MOVEit Transfer - SQL Injection | moveit transfer | 9.1 (v3.1) | Critical |
| CVE-2026-47168 | EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params | espocrm | 9.1 (v3.1) | Critical |
| CVE-2008-4687 | Mantis manage_proj_page PHP Code Execution | mantis | 9.0 (v2.0) | High |
| CVE-2009-1978 | Oracle Secure Backup Authentication Bypass/Command Injection Vulnerability | secure backup | 9.0 (v2.0) | High |
| CVE-2026-14602 | Remote API <= 0.2 - Unauthenticated PHP Object Injection via remote-api Query Parameter | Remote API | 9.0 (v3.1) | Critical |
| CVE-2018-11442 | EasyService Billing 1.0 - Cross-Site Request Forgery | easyservice billing | 8.8 (v3.0) | High |
| CVE-2018-11445 | EasyService Billing 1.0 - Cross-Site Request Forgery | easyservice billing | 8.8 (v3.0) | High |
| CVE-2019-12840 | Webmin Package Updates Remote Command Execution | webmin | 8.8 (v3.0) | High |
| CVE-2019-15642 | Webmin < 1.920 - Authenticated Remote Code Execution | webmin | 8.8 (v3.0) | High |
| CVE-2020-28328 | SuiteCRM Log File Remote Code Execution | suitecrm | 8.8 (v3.1) | High |
| CVE-2021-42840 | SuiteCRM Log File Remote Code Execution | suitecrm | 8.8 (v3.1) | High |
| CVE-2022-33891 | Apache Spark Unauthenticated Command Injection RCE | spark | 8.8 (v3.1) | High |
| CVE-2023-2288 | Otter - Gutenberg Blocks < 2.2.6 - Author+ PHAR Deserialization | otter | 8.8 (v3.1) | High |
| CVE-2023-34127 | Sonicwall | analytics | 8.8 (v3.1) | High |
| CVE-2026-113779 | pfSense REST API package Vulnerable to Privilege Escalation via Scoped HA Settings Sync Permission | pfSense-pkg-RESTAPI | 8.8 (v3.1) | High |
| CVE-2026-8365 | Blocksy <= 2.1.41 - Authenticated (Contributor+) PHP Object Injection via Deserialization of Untrusted Data via 'blocksy | Blocksy | 8.8 (v3.1) | High |
| CVE-2022-41800 | F5 BIG-IP iControl Authenticated RCE via RPM Creator | big-ip access policy manager | 8.7 (v3.1) | High |
| CVE-2025-71260 | BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 VIEWSTATE Deserialization RCE | footprints | 8.7 (v4.0) | High |
| CVE-2026-47722 | nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml | nebula-mesh | 8.7 (v4.0) | High |
| CVE-2026-71981 | Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter | cypht | 8.7 (v4.0) | High |
| CVE-2021-22214 | Gitlab CE/EE 10.5 - Server-Side Request Forgery | gitlab | 8.6 (v3.1) | High |
| CVE-2026-29001 | TastyIgniter 4.4.5 PHP Object Injection via Settings Deserialization | TastyIgniter | 8.6 (v4.0) | High |
| CVE-2026-56739 | Logto: SSRF via Webhooks and Custom OAuth2 Connector UserInfo Endpoint | logto | 8.5 (v4.0) | High |
| CVE-2014-3120 | ElasticSearch Remote Code Execution (CVE-2014-3120) | elasticsearch | 8.1 (v3.1) | High |
| CVE-2018-1000130 | Jolokia Agent - JNDI Code Injection | webarchive agent | 8.1 (v3.0) | High |
| CVE-2026-40280 | Gotenberg <= 8.30.1 - Server Side Request Forgery | gotenberg | 7.8 (v4.0) | High |
| CVE-2026-93872 | Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter | Cotonti | 7.7 (v4.0) | High |
| CVE-2011-4448 | WikkaWiki 1.3.2 - Multiple Vulnerabilities | wikkawiki | 7.5 (v2.0) | High |
| CVE-2013-2050 | Red Hat CloudForms Management Engine 5.1 miq_policy/explorer SQL Injection | cloudforms management engine | 7.5 (v2.0) | High |
| CVE-2015-1592 | SixApart MovableType Storable Perl Code Execution | debian linux | 7.5 (v2.0) | High |
| CVE-2017-10271 | Weblogic < 10.3.6 'wls-wsat' XMLDecoder Deserialization Remote Command Execution (CVE-2017-10271) | weblogic server | 7.5 (v3.1) | High |
| CVE-2018-19518 | PHP IMAP Remote Command Execution (CVE-2018-19518) | php | 7.5 (v3.1) | High |
| CVE-2023-34133 | Sonicwall | analytics | 7.5 (v3.1) | High |
| CVE-2025-63950 | twittodon Unsafe Deserialization Vulnerability | twittodon | 7.5 (v3.1) | High |
| CVE-2025-63951 | phoniebox Unsafe Deserialization Vulnerability | phoniebox | 7.5 (v3.1) | High |
| CVE-2026-12720 | Kirki < 6.0.13 - Unauthenticated PHP Object Injection | Kirki | 7.5 (v3.1) | High |
| CVE-2026-19913 | Kaltura HTML5 Video Player, html5lib library Improper Input Validation Vulnerability | Kaltura HTML5 Video Player, html5lib library | 7.5 (v3.1) | High |
| CVE-2026-61686 | SolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context prop | SolidInvoice | 7.5 (v3.1) | High |
| CVE-2019-1936 | Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities | integrated management controller supervisor | 7.2 (v3.1) | High |
| CVE-2020-14144 | Gitea Git Hooks Remote Code Execution | gitea | 7.2 (v3.1) | High |
| CVE-2020-14295 | Cacti color filter authenticated SQLi to RCE | cacti | 7.2 (v3.1) | High |
| CVE-2020-14883 | Oracle WebLogic Server Administration Console Handle RCE | weblogic server | 7.2 (v3.1) | High |
| CVE-2026-29782 | OpenSTAManager: Remote Code Execution via Insecure Deserialization in OAuth2 | openstamanager | 7.2 (v3.1) | High |
| CVE-2025-71257 | BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Authentication Bypass | footprints itsm | 6.9 (v4.0) | Medium |
| CVE-2026-97865 | Open-Web-Analytics Remote Event Queue Endpoint queue.php loadFromArray deserialization | Open-Web-Analytics | 6.9 (v4.0) | Medium |
| CVE-2011-4449 | WikkaWiki 1.3.2 - Multiple Vulnerabilities | wikkawiki | 6.8 (v2.0) | Medium |
| CVE-2011-4452 | WikkaWiki 1.3.2 - Multiple Vulnerabilities | wikkawiki | 6.8 (v2.0) | Medium |
| CVE-2013-4490 | Gitlab-shell Code Execution | gitlab | 6.5 (v2.0) | Medium |
| CVE-2011-4450 | WikkaWiki 1.3.2 - Multiple Vulnerabilities | wikkawiki | 6.4 (v2.0) | Medium |
| CVE-2024-32231 | Stash < 0.26.0 - SQL Injection | stash | 6.3 (v3.1) | Medium |
| CVE-2025-7825 | Schema Plugin For Divi, Gutenberg & Shortcodes <= 4.3.2 - Authenticated (Contributor+) Object Instantiation | Schema Plugin For Divi, Gutenberg & Shortcodes | 6.3 (v3.1) | Medium |
| CVE-2025-48954 | Discourse OAuth Social Login - Cross-site Scripting | discourse | 6.1 (v3.1) | Medium |
| CVE-2025-13439 | Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Information Disclosure and PHAR Deserializatio | Fancy Product Designer | 5.9 (v3.1) | Medium |
| CVE-2010-0904 | Oracle Secure Backup Authentication Bypass/Command Injection Vulnerability | secure backup | 5.0 (v2.0) | Medium |
| CVE-2013-2641 | Sophos Web Protection Appliance patience.cgi Directory Traversal | web appliance firmware | 5.0 (v2.0) | Medium |
| CVE-2011-4451 | WikkaWiki 1.3.2 - Multiple Vulnerabilities | wikkawiki | 4.3 (v2.0) | Medium |
| CVE-2013-2643 | Sophos Web Protection Appliance 3.7.8.1 - Multiple Vulnerabilities | web appliance firmware | 4.3 (v2.0) | Medium |
| CVE-2026-16297 | Clearfy < 2.4.3 - Admin+ PHP Object Injection via Settings Import | Clearfy Cache | 4.1 (v3.1) | Medium |
| CVE-2023-3360 | Weaver Show Posts < 1.8.1 - Admin+ PHP Object Injection | Weaver Show Posts | 3.3 (v3.1) | Low |
| CVE-2026-90575 | PHPGurukul Small CRM Login Success login.php unserialize deserialization | Small CRM | 2.9 (v4.0) | Low |
| CVE-2025-15438 | PluXml Media Management medias.php __destruct deserialization | pluxml | 2.0 (v4.0) | Low |
| CVE-2018-1000859 | php imap_open Remote Code Execution | - | N/A | N/A |
Observed CWEs
These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.