Atomicorp WAF Rule 345492

Rule Summary

• Rule ID: 345492
• Status: Active
• Alert message: Possible CSRF Attack - High Confidence Score
• Observed CWEs: None documented
• Reviewed CWE mapping: CWE-352 (Cross-Site Request Forgery (CSRF))
• Rule severity: Error (3)
• Phase: 1 (request headers)
• Rule action: pass
• Public tags: ASL/CSRF
• Logging: log, auditlog

Description

Rule 345492 is generated when Atomicorp’s scored Cross-Site Request Forgery (CSRF) detector calculates a score of 8 or 9. Multiple indicators strongly suggest that a state-changing browser request originated outside the expected application context. This rule logs the request for investigation but does not deny it or set an HTTP response status. Another rule may independently block the same transaction.

The method only enables evaluation; POST, PUT, PATCH, and DELETE are not attacks merely because of the method. Missing Fetch Metadata, Origin, and Referer headers do not add to the score.

Troubleshooting

Review the endpoint, method, final score, fetch_site, origin, origin_authority, referer, referer_authority, cookies, and credentials. Determine whether the reported source is authorized for that specific endpoint. A cross-site signal plus an authority mismatch reaches score 8; cookie presence can raise that combination to 9.

Legitimate cross-origin authentication flows, payment returns, and browser APIs may intentionally produce this score. Preserve their protocol-specific validation even when exempting them from the generic detector.

False Positives

A legitimate cross-origin application flow can look like CSRF without being hostile. If the transaction is expected, use a narrowly scoped local exemption. If the detection does not match the documented conditions, report it to Atomicorp Support. An unexpected source should be investigated as a likely CSRF attempt or abnormal browser flow.

Tuning Guidance

Do not edit 70_asl_csrf_experimental_v2.conf or another Atomicorp-managed rule file. Use customer-owned local ModSecurity configuration and an unused local rule ID in the 1-99999 range.

For an expected endpoint, set TX:ASL_CSRF_EXEMPT=1 with an earlier phase-1 rule and scope it by Host and path when possible:

SecRule REQUEST_URI "@beginsWith /payments/return" \
    "id:91007,phase:1,pass,nolog,noauditlog,t:none,setvar:tx.asl_csrf_exempt=1"

Custom session recognition can be added with earlier local settings for TX:ASL_CSRF_AUTHENTICATED and TX:ASL_CSRF_CREDENTIAL_STATUS; this improves accuracy and is not an exemption. Transaction-variable tuning must execute before the CSRF ruleset. Standard SecRuleRemoveById customization is a separate mechanism; globally removing 345492 suppresses all high-confidence score events and is not the preferred correction for one legitimate endpoint.

Configuration Notes

• Effective condition: TX:ASL_CSRF_SCORE >= 8 and < 10.
• Action: pass; phase 1; logged and audit logged; no HTTP denial status is set.
• This score range remains detection-only even when enforcement is enabled; blocking begins at score 10.
• Origin is preferred over Referer, which is evaluated only when Origin is absent.

Additional Information

Score model

For example, cross-site (+5) plus an Origin mismatch (+3) produces score 8. Adding cookies (+1) produces score 9. Authority comparison ignores scheme and normalizes default ports. Bearer tokens are not built-in ambient authentication, and the presence of a CSRF token or header is not treated as proof that it is valid.

Event fields

score is the final risk score; method is the request method; host is the target authority; fetch_site is a validated Fetch Metadata value; provenance describes availability of browser provenance; origin and referer report values such as multiple, null, invalid, or mismatch; their _authority fields contain normalized parsed authorities; cookies reports cookie presence; and credentials describes recognized ambient credential state.

Similar Rules

345490 is the enforcement event at score 10 or greater. 345491 is its detection-only counterpart. 345493 records scores 5-7.

Outside References

• Atomicorp ModSecurity guidance
• Atomicorp rule tuning guidance
• W3C Fetch Metadata (opens in a new tab)
• OWASP CSRF Prevention Cheat Sheet (opens in a new tab)

Selected Related CVEs

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

No selected related public CVE research notes are currently published.

Reviewed CWE Mapping

These are explicit, human-reviewed mappings of this rule’s documented detection purpose. They are distinct from Observed CWEs derived from published CVE test evidence.