On this page

Atomicorp WAF Rule 388000

Rule Summary

  • Rule ID: 388000
  • Status: Active
  • Alert message: Atomicorp.com WAF Rules - Virtual Just In Time Patch: Possible Attempt to Access vulnerable FCKeditor file upload connector (Disable if you have configured this connector to require authentication)
  • Observed CWEs: None documented
  • Revision: 1
  • Rule severity: Critical (2)
  • Phase: 2 (request body)
  • Request surfaces: Request filename
  • Rule action: deny
  • HTTP status: 403
  • Logging: log, auditlog

Description

This rule detects the use of FCKEditor file upload connector. This tool has the potential to be used in an unauthenticated manner, making it possible for attackers to upload files to your system without your permissions. A number of web applications use this connector, and configure it an unauthenticated manner.

This rules work by detecting the use of this connector.

False Positives

A false positive can only occur when an the application is used in an authenticated manner. If you know that this connector is properly protected, then disable this rule. However, if the application is not properly protected, disabling this rule will make it possible for anyone to upload files to the system. This method is well known and is used regularly to compromise hosts.

Tuning Guidance

If you know that this behavior is acceptable for your application, please log into your ASL gui, click on Configuration, then Rules Manager. And disable this rule only for the virtual hosts that use it. We do not recommend you disable this rule globally.

If you are not using ASL , then you will have to manually configure your modsecurity rules for your needs. Please see the Tuning the Atomicorp WAF Rules page for basic information.

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

No selected related public CVE research notes are currently published.

Documentation Source

  • Original wiki page: WAF 388000
  • Source revision: 1750
  • Source revision date: 2011-07-24