Atomicorp WAF Rule 390614

Rule Summary

• Rule ID: 390614
• Status: Active
• Alert message: Atomicorp.com WAF Rules: Null Byte Attack Blocked (Invalid character in ARGS)
• Observed CWEs: CWE-20 (5), CWE-22 (129), CWE-73 (1), CWE-74 (1), CWE-77 (1), CWE-78 (2), CWE-88 (1), CWE-89 (3), CWE-94 (7), CWE-96 (1), CWE-120 (1), CWE-158 (1), CWE-200 (1), CWE-264 (1), CWE-306 (1), CWE-310 (1), CWE-434 (2), CWE-502 (29), CWE-862 (1)
• Revision: 23
• Rule severity: Critical (2)
• Phase: 2 (request body)
• Rule action: deny
• HTTP status: 403
• Logging: log, auditlog

Description

This rules detects NULL characters in unusual arguments. NULL characters are often used by attackers to try an bypass intrusion detection systems, as there have been vulnerabilities in IDS’ (including modsecurity) that have allowed attackers to bypass IDS systems. WAFs will commonly ignore everything after the null but pass the entire string to web server where it is processed. The Rules will detect the use of NULL characters and will block them.

Example attack'

GET /index.php?option=com_shoutbox&controller=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1

The last character in this request is a null, which is invalid and is part of an actual attack on the system. The above example is an attacker attempting to access the Linux /proc file system via a recursion attack, with an added NULL character at the end to attempt to evade the IDS system.

Troubleshooting

False Positives

The rule contains logic to detect cases where the use of NULL characters is non-malicious. In some cases, an application may do this in a new way that logic can not detect. If you believe this is a false positive, please report this to our security team to determine if this is a legitimate case, or if its clever attack on your system. Instructions to report false positives are detailed on the Reporting False Positives wiki page. If it is a false positive, we will fix the issue in the rules and get a release out to you promptly.

Tuning Guidance

If you want to disable this rule, please see the Tuning the Atomicorp WAF Rules page for basic information.

Additional Information

Similar Rules

WAF_340614

WAF_340613

Selected Related CVEs

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

Observed CWEs

These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.

Documentation Source

• Original wiki page: WAF 390614
• Source revision: 5805
• Source revision date: 2017-01-13