Atomicorp WAF Rule 350148

Rule Summary

• Rule ID: 350148
• Status: Active
• Alert message: Atomicorp.com WAF Rules: Potentially Untrusted Web Content Detected
• Observed CWEs: CWE-20 (8), CWE-22 (4), CWE-73 (1), CWE-74 (4), CWE-78 (1), CWE-79 (1157), CWE-80 (16), CWE-83 (4), CWE-87 (8), CWE-89 (5), CWE-94 (234), CWE-113 (1), CWE-116 (7), CWE-183 (1), CWE-184 (1), CWE-185 (1), CWE-200 (4), CWE-264 (3), CWE-269 (1), CWE-287 (2), CWE-290 (1), CWE-306 (1), CWE-345 (3), CWE-352 (4), CWE-434 (11), CWE-436 (1), CWE-444 (1), CWE-521 (1), CWE-601 (4), CWE-610 (1), CWE-611 (1), CWE-625 (1), CWE-639 (1), CWE-640 (1), CWE-693 (1), CWE-732 (1), CWE-749 (1), CWE-798 (2), CWE-862 (1), CWE-915 (1), CWE-918 (1), CWE-1188 (1), CWE-1321 (1), CWE-1336 (1)
• Revision: 169
• Rule severity: Critical (2)
• Phase: 2 (request body)
• Request surfaces: Request URI
• Rule action: deny
• HTTP status: 403
• Logging: log, auditlog

Description

This rules detects when potentially untrusted web content is used in a client request. For example, if javascript is included in a variable that appears to not be used for this purpose, or if web code is included in a portion of a request that is not known to be used for this purpose. This rule looks for various encoded methods.

Troubleshooting

False Positives

This rule may produce a false positive if an application is used in a previously unknown or untested manner. The rules contain a large library of known trusted methods, however it is possible an application may be using a previously untested method. It is not recommended that you disable this rule if you have a false positive. If you believe this is a false positive, please report this to our security team to determine if this is a legitimate case, or if its clever attack on your system. Instructions to report false positives are detailed on the Reporting False Positives wiki page. If it is a false positive, we will fix the issue in the rules and get a release out to you promptly.

Tuning Guidance

See the Mod_security page for guidance on tuning this rule.

Additional Information

Similar Rules

WAF 350147

Selected Related CVEs

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.