Atomicorp WAF Rule 345493

Rule Summary

• Rule ID: 345493
• Status: Active
• Alert message: Possible CSRF Attack - Suspicious Score
• Observed CWEs: CWE-20 (3), CWE-22 (3), CWE-79 (20), CWE-89 (15), CWE-94 (1), CWE-269 (1), CWE-284 (1), CWE-287 (2), CWE-294 (1), CWE-327 (1), CWE-352 (4), CWE-425 (1), CWE-434 (7), CWE-521 (1), CWE-611 (2), CWE-732 (1), CWE-798 (1), CWE-918 (1)
• Reviewed CWE mapping: CWE-352 (Cross-Site Request Forgery (CSRF))
• Rule severity: Warning (4)
• Phase: 1 (request headers)
• Rule action: pass
• Public tags: ASL/CSRF
• Logging: log, auditlog

Description

Rule 345493 is generated when Atomicorp’s scored Cross-Site Request Forgery (CSRF) detector calculates a transaction score from 5 through 7. The request contains enough browser-provenance, Origin or Referer, cookie, or credential indicators to warrant investigation, but the evidence has not reached the high-confidence threshold. This rule logs the request and does not deny it or set an HTTP response status. Another rule may independently block the same transaction.

A validated Sec-Fetch-Site: cross-site signal contributes 5 points and can produce this event without another mismatch. The alert is not proof that an attack succeeded. POST, PUT, PATCH, and DELETE only enable evaluation and are not attacks merely because of their method.

Troubleshooting

Review the request URI, method, final score, fetch_site, origin, origin_authority, referer, referer_authority, cookies, and credentials. Determine whether the source is expected for that endpoint and whether the user session and application action make sense.

Common legitimate causes include intentional cross-origin submissions, SAML or OIDC authentication flows, payment-provider browser returns, cross-origin browser APIs, application topology spanning multiple origins, and proxies or middleware affecting provenance headers. If the source is expected, use a narrow local exemption. If it is unexpected, investigate the request and associated session.

False Positives

Legitimate cross-origin application flows can intentionally produce the characteristics used by the detector. If the transaction is expected, configure a narrowly scoped local exemption rather than modifying the Atomicorp rule. If traffic should not meet the documented conditions, report the event to Atomicorp Support as a possible false positive.

Tuning Guidance

Do not edit 70_asl_csrf_experimental_v2.conf or any other Atomicorp-managed rule file. Place application-specific tuning in customer-owned local ModSecurity configuration. Use an unused customer rule ID in the 1-99999 range and never reuse an Atomicorp 300000-399999 ID.

For a legitimate endpoint, set TX:ASL_CSRF_EXEMPT=1 from an earlier phase-1 local rule, narrowed by Host and path where practical:

SecRule REQUEST_URI "@beginsWith /oidc/callback" \
    "id:91008,phase:1,pass,nolog,noauditlog,t:none,setvar:tx.asl_csrf_exempt=1"

The application must continue performing its own protocol-specific validation. Local transaction-variable tuning must execute before the CSRF ruleset. Standard SecRuleRemoveById customization follows the normal Atomicorp process and is distinct; globally removing 345493 suppresses suspicious-score visibility for every application and should not be the first choice for one expected endpoint.

Configuration Notes

• Effective condition: TX:ASL_CSRF_SCORE >= 5 and < 8.
• Action: pass; phase 1; logged and audit logged; no HTTP denial status is set.
• Missing usable Fetch Metadata, Origin, or Referer is telemetry only and adds no score.
• Safe methods are skipped unless a local application profile identifies a known state-changing operation.

Additional Information

Score model

Origin takes precedence over Referer. Authority comparison ignores scheme and normalizes default ports. Cookies indicate browser-managed state but do not prove authentication. Bearer tokens are excluded from built-in ambient authentication, and a CSRF token or header is not automatically trusted.

Event fields

score is the final risk score; method is the HTTP method; host is the routed target authority; fetch_site is the validated Fetch Metadata value; provenance=unavailable means no usable provenance was present and does not itself indicate an attack; origin and referer describe parsing and comparison results; their _authority fields contain normalized parsed authorities; cookies=present adds one point; and credentials identifies recognized ambient state such as session-cookie or http-auth.

Example

Sec-Fetch-Site: cross-site contributes 5 points, producing rule 345493 when no additional evidence raises the score. The event should be investigated, but this rule did not block the request.

Similar Rules

345490 enforces scores of 10 or greater when enabled. 345491 records critical detection-only events. 345492 records scores 8-9.

Outside References

• Atomicorp ModSecurity guidance
• Atomicorp rule tuning guidance
• W3C Fetch Metadata (opens in a new tab)
• OWASP CSRF Prevention Cheat Sheet (opens in a new tab)

Selected Related CVEs

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

Observed CWEs

These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.

Reviewed CWE Mapping

These are explicit, human-reviewed mappings of this rule’s documented detection purpose. They are distinct from Observed CWEs derived from published CVE test evidence.