On this page
Atomicorp WAF Rule 344380
Rule Summary
- Rule ID: 344380
- Status: Active
- Alert message: Atomicorp.com WAF Rules: Deserialization gadget chain detected (Java/.NET)
- Observed CWEs: CWE-20 (3), CWE-22 (1), CWE-73 (1), CWE-78 (1), CWE-94 (2), CWE-434 (1), CWE-502 (16)
- Revision: 1
- Rule severity: Critical
- Phase: 2 (request body)
- Request surfaces: Request body, Request arguments, JSON request data, SOAP request data
- Rule action: deny
- HTTP status: 403
- Logging: log, auditlog
Description
This rule detects behavior identified by its current alert as “Deserialization gadget chain detected (Java/.NET)” in the request body, request arguments, JSON request data, SOAP request data. It evaluates during the request body phase and denies matching traffic with HTTP status 403.
Selected Related CVEs
This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.
| CVE | Vulnerability | Product | CVSS | Severity |
|---|---|---|---|---|
| CVE-2026-34838 | Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in AbstractSettingsCollection | group-office | 9.9 (v3.1) | Critical |
| CVE-2015-7501 | Red Hat JBoss - Insecure Deserialization | jboss enterprise application platform | 9.8 (v3.0) | Critical |
| CVE-2017-18349 | Fastjson Insecure Deserialization - Remote Code Execution | fastjson | 9.8 (v3.0) | Critical |
| CVE-2019-17564 | Apache Dubbo 2.5.x-2.7.4 - Insecure Deserialization | dubbo | 9.8 (v3.1) | Critical |
| CVE-2020-10189 | ManageEngine Desktop Central Java Deserialization | manageengine desktop central | 9.8 (v3.1) | Critical |
| CVE-2023-29300 | Adobe ColdFusion - Pre-Auth Remote Code Execution | coldfusion | 9.8 (v3.1) | Critical |
| CVE-2023-38203 | Adobe ColdFusion - Deserialization of Untrusted Data | coldfusion | 9.8 (v3.1) | Critical |
| CVE-2023-43208 | NextGen Healthcare Mirth Connect - Remote Code Execution | mirth connect | 9.8 (v3.1) | Critical |
| CVE-2026-19912 | Kaltura HTML5 Video Player, html5 library Arbitrary Code Execution Vulnerability | Kaltura HTML5 Video Player, html5 library | 9.8 (v3.1) | Critical |
| CVE-2026-10042 | manga-image-translator RCE via Unsafe Pickle Deserialization in Share Model | manga-image-translator | 9.2 (v4.0) | Critical |
| CVE-2026-87930 | MaxSite CMS through 109.6 PHP Object Injection via ci_session | MaxSite CMS | 9.2 (v4.0) | Critical |
| CVE-2021-21351 | XStream <1.4.16 - Remote Code Execution | xstream | 9.1 (v3.1) | Critical |
| CVE-2025-5086 | Dassault Systèmes DELMIA Apriso (up to 2025) - Insecure Deserialization | delmia apriso | 9.0 (v3.1) | Critical |
| CVE-2026-14602 | Remote API <= 0.2 - Unauthenticated PHP Object Injection via remote-api Query Parameter | Remote API | 9.0 (v3.1) | Critical |
| CVE-2026-47722 | nebula-mesh: Host advanced overrides allow YAML injection into agent config.yml | nebula-mesh | 8.7 (v4.0) | High |
| CVE-2026-71981 | Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter | cypht | 8.7 (v4.0) | High |
| CVE-2026-12720 | Kirki < 6.0.13 - Unauthenticated PHP Object Injection | Kirki | 7.5 (v3.1) | High |
| CVE-2026-19913 | Kaltura HTML5 Video Player, html5lib library Improper Input Validation Vulnerability | Kaltura HTML5 Video Player, html5lib library | 7.5 (v3.1) | High |
| CVE-2026-61686 | SolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context prop | SolidInvoice | 7.5 (v3.1) | High |
| CVE-2026-16297 | Clearfy < 2.4.3 - Admin+ PHP Object Injection via Settings Import | Clearfy Cache | 4.1 (v3.1) | Medium |
| CVE-2023-3360 | Weaver Show Posts < 1.8.1 - Admin+ PHP Object Injection | Weaver Show Posts | 3.3 (v3.1) | Low |
Observed CWEs
These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.