On this page
Atomicorp WAF Rule 390714
Rule Summary
- Rule ID: 390714
- Status: Active
- Alert message: Atomicorp.com WAF Rules: HTTP Splitting (CR/LF in request filename detected)
- Observed CWEs: CWE-22 (2), CWE-74 (3), CWE-79 (1), CWE-93 (2), CWE-120 (1), CWE-787 (1)
- Revision: 2
- Rule severity: Critical (2)
- Phase: 1 (request headers)
- Request surfaces: Request filename
- Rule action: deny
- HTTP status: 403
- Logging: log, auditlog
Description
This rule detects behavior identified by its current alert as “HTTP Splitting (CR/LF in request filename detected)” in the request filename. It evaluates during the request headers phase and denies matching traffic with HTTP status 403.
Selected Related CVEs
This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.
| CVE | Vulnerability | Product | CVSS | Severity |
|---|---|---|---|---|
| CVE-2019-11043 | PHP-FPM Path Info Buffer Underflow - Remote Code Execution | php | 9.8 (v3.1) | Critical |
| CVE-2019-16278 | nostromo 1.9.6 - Remote Code Execution | nostromo nhttpd | 9.8 (v3.1) | Critical |
| CVE-2020-5902 | F5 BIG-IP TMUI - Remote Code Execution | big-ip access policy manager | 9.8 (v3.1) | Critical |
| CVE-2021-27132 | Sercomm VD625 Smart Modems - CRLF Injection | agcombo vd625 firmware | 9.8 (v3.1) | Critical |
| CVE-2022-35507 | Proxmox - CRLF Injection | proxmox mail gateway | 7.1 (v3.1) | High |
| CVE-2016-4975 | Apache mod_userdir CRLF injection | http server | 6.1 (v3.0) | Medium |
| CVE-2017-5868 | OpenVPN Access Server 2.1.4 - CRLF Injection | openvpn access server | 6.1 (v3.0) | Medium |
| CVE-2019-6802 | Pypiserver <1.2.5 - Carriage Return Line Feed Injection | pypiserver | 6.1 (v3.0) | Medium |
Observed CWEs
These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.