Atomicorp WAF Rule 350147

Rule Summary

• Rule ID: 350147
• Status: Active
• Alert message: Atomicorp.com WAF Rules: Potentially Untrusted Web Content Detected
• Observed CWEs: CWE-20 (8), CWE-22 (3), CWE-27 (1), CWE-73 (1), CWE-74 (4), CWE-78 (8), CWE-79 (1100), CWE-80 (15), CWE-83 (4), CWE-87 (5), CWE-89 (9), CWE-91 (1), CWE-94 (255), CWE-95 (1), CWE-113 (1), CWE-116 (11), CWE-119 (2), CWE-183 (1), CWE-184 (1), CWE-185 (1), CWE-200 (3), CWE-264 (2), CWE-284 (1), CWE-285 (1), CWE-287 (6), CWE-295 (2), CWE-306 (3), CWE-345 (3), CWE-352 (7), CWE-434 (12), CWE-436 (1), CWE-444 (1), CWE-502 (4), CWE-601 (2), CWE-610 (1), CWE-611 (3), CWE-625 (1), CWE-639 (1), CWE-693 (1), CWE-732 (1), CWE-749 (1), CWE-798 (1), CWE-862 (2), CWE-913 (1), CWE-915 (1), CWE-918 (4), CWE-1004 (2), CWE-1188 (1), CWE-1321 (1), CWE-1336 (2)
• Revision: 168
• Rule severity: Critical (2)
• Phase: 2 (request body)
• Request surfaces: Request argument names, Request arguments, JSON request data, SOAP request data
• Rule action: deny
• HTTP status: 403
• Logging: log, auditlog

Description

This rules detects when potentially untrusted web content is used in a client request. For example, if javascript is included in a variable that appears to not be used for this purpose, or if web code is included in a portion of a request that is not known to be used for this purpose.

Troubleshooting

False Positives

This rule may produce a false positive if an application is used in a previously unknown or untested manner. The rules contain a large library of known trusted methods, however it is possible an application may be using a previously untested method. It is not recommended that you disable this rule if you have a false positive. If you believe this is a false positive, please report this to our security team to determine if this is a legitimate case, or if its clever attack on your system. Instructions to report false positives are detailed on the Reporting False Positives wiki page. If it is a false positive, we will fix the issue in the rules and get a release out to you promptly.

Tuning Guidance

See the Mod_security page for guidance on tuning this rule.

Additional Information

Similar Rules

WAF 350148

Selected Related CVEs

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.