On this page

Atomicorp WAF Rule 380801

Rule Summary

  • Rule ID: 380801
  • Status: Active
  • Alert message: Atomicorp.com WAF Rules - Virtual Just In Time Patch: PHP Easter Egg Access
  • Observed CWEs: None documented
  • Revision: 1
  • Rule severity: Critical (2)
  • Phase: 2 (request body)
  • Request surfaces: Request URI
  • Rule action: deny
  • Logging: log, auditlog

Description

This rule detects attempts to access PHP Easter Egges. PHP contains several “easter eggs” that can be sent to any PHP application to determine if the system is running PHP and what version of PHP a system is using. PHP will reveal this information, via these Easter Eggs, even if PHP is configured to not reveal its version or other information.

This rule works by detecting the use of these easter eggs, which are PHP session IDs reserved as easter eggs. The easter eggs are referenced in the section “Outside References” at the end of this article.

False Positives

There are no known false positives for this condition. If you believe your version of PHP is not vulnerable to this probe, then disable this rule. We do not recommend you do this without first testing your PHP implementation against the known probe easter eggs.

Tuning Guidance

Please see the Tuning the Atomicorp WAF Rules page for basic information.

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

No selected related public CVE research notes are currently published.

Documentation Source

  • Original wiki page: WAF 380801
  • Source revision: 3034
  • Source revision date: 2012-12-27