Atomicorp WAF Rule 390613

Rule Summary

• Rule ID: 390613
• Status: Active
• Alert message: Atomicorp.com WAF Rules: Null Byte Attack Blocked (Invalid character in request or headers)
• Observed CWEs: CWE-20 (2), CWE-22 (118), CWE-73 (1), CWE-77 (1), CWE-89 (2), CWE-94 (2), CWE-200 (1), CWE-306 (1), CWE-502 (5), CWE-862 (1)
• Revision: 10
• Rule severity: Critical (2)
• Phase: 2 (request body)
• Request surfaces: Request URI, Request headers, Request arguments, JSON request data, SOAP request data
• Rule action: deny
• HTTP status: 403
• Logging: log, auditlog

Description

This rules detects NULL characters in the request URL or in a header for the request. NULL characters are often used by attackers to try an bypass intrusion detection systems, as there have been vulnerabilities in IDS’ (including modsecurity) that have allowed attackers to bypass IDS systems. The Rules will detect the use of NULL characters and will block them.

Example attack'

GET /index.php?option=com_shoutbox&controller=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1

The last character in this request is a null, which is invalid and is part of an actual attack on the system. The above example is an attacker attempting to access the Linux /proc file system via a recursion attack, with an added NULL character at the end to attempt to evade the IDS system.

Similar Rules

WAF_340614

WAF_340613

Selected Related CVEs

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

Observed CWEs

These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.

Documentation Source

• Original wiki page: WAF 390613
• Source revision: 1094
• Source revision date: 2010-11-18