On this page
Atomicorp WAF Rule 390724
Rule Summary
- Rule ID: 390724
- Status: Active
- Alert message: Atomicorp.com WAF Rules: HTTP ARGS Injection Attack via payload (CR/LF detected)
- Observed CWEs: CWE-20 (3), CWE-22 (7), CWE-23 (1), CWE-74 (1), CWE-77 (1), CWE-78 (4), CWE-79 (4), CWE-89 (7), CWE-94 (3), CWE-119 (1), CWE-120 (1), CWE-200 (3), CWE-255 (1), CWE-264 (1), CWE-269 (1), CWE-284 (1), CWE-287 (1), CWE-294 (1), CWE-352 (1), CWE-434 (3), CWE-502 (1), CWE-521 (1), CWE-732 (1), CWE-798 (1), CWE-862 (1)
- Rule severity: Alert (1)
- Phase: 2 (request body)
- Request surfaces: Request argument names, JSON request data, SOAP request data
- Rule action: deny
- HTTP status: 403
- Public tags: attack-protocol
- Logging: log, auditlog
Description
This rule detects behavior identified by its current alert as “HTTP ARGS Injection Attack via payload (CR/LF detected)” in the request argument names, JSON request data, SOAP request data. It evaluates during the request body phase and denies matching traffic with HTTP status 403.
Selected Related CVEs
This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.
| CVE | Vulnerability | Product | CVSS | Severity |
|---|---|---|---|---|
| CVE-1999-1011 | MS99-025 Microsoft IIS MDAC msadcs.dll RDS Arbitrary Remote Command Execution | data access components | 10.0 (v2.0) | High |
| CVE-2008-3257 | Oracle Weblogic Apache Connector POST Request Buffer Overflow | weblogic server | 10.0 (v2.0) | High |
| CVE-2013-5755 | Yealink VoIP Phone SIP-T38G - Remote Command Execution | sip-t38g | 10.0 (v2.0) | High |
| CVE-2025-45854 | JEHC-BPM - Remote Code Execute | jehc-bpm | 10.0 (v3.1) | Critical |
| CVE-2015-1427 | ElasticSearch Groovy Sandbox Bypass and Remote Code Execution (CVE-2015-1427) | elasticsearch | 9.8 (v3.1) | Critical |
| CVE-2015-3933 | GeniXCMS 0.0.3 - 'register.php' SQL Injection | genixcms | 9.8 (v3.0) | Critical |
| CVE-2017-16935 | Ametys CMS 4.0.2 - Password Reset | ametys | 9.8 (v3.0) | Critical |
| CVE-2017-17999 | RISE 1.9 - 'search' SQL Injection | rise ultimate project manager | 9.8 (v3.0) | Critical |
| CVE-2017-9811 | Kaspersky Anti-Virus File Server 8.0.3.297 - Multiple Vulnerabilities | anti-virus for linux server | 9.8 (v3.0) | Critical |
| CVE-2019-16278 | Nostromo Directory Traversal Remote Command Execution | nostromo nhttpd | 9.8 (v3.1) | Critical |
| CVE-2019-17564 | Apache Dubbo 2.5.x-2.7.4 - Insecure Deserialization | dubbo | 9.8 (v3.1) | Critical |
| CVE-2019-1935 | Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities | integrated management controller supervisor | 9.8 (v3.1) | Critical |
| CVE-2019-1937 | Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities | integrated management controller supervisor | 9.8 (v3.0) | Critical |
| CVE-2020-11984 | Apache HTTP Server - Remote Code Execution | http server | 9.8 (v3.1) | Critical |
| CVE-2020-35476 | OpenTSDB Arbitrary Command Injection Remote Code Execution (CVE-2020-35476) | opentsdb | 9.8 (v3.1) | Critical |
| CVE-2021-42325 | Froxlor 0.10.29.1 - SQL Injection (Authenticated) | froxlor | 9.8 (v3.1) | Critical |
| CVE-2023-25826 | OpenTSDB Arbitrary Command Injection Remote Code Execution（CVE-2023-25826） | opentsdb | 9.8 (v3.1) | Critical |
| CVE-2023-47246 | SysAid Server - Remote Code Execution | sysaid on-premises | 9.8 (v3.1) | Critical |
| CVE-2024-55956 | Cleo LexiCom, VLTrader, and Harmony Unauthenticated Remote Code Execution | harmony | 9.8 (v3.1) | Critical |
| CVE-2013-5758 | Yealink VoIP Phone SIP-T38G - Privilege Escalation | sip-t38g | 9.0 (v2.0) | High |
| CVE-2016-0710 | Apache Jetspeed Arbitrary File Upload | jetspeed | 8.8 (v3.0) | High |
| CVE-2017-6823 | Fiyo CMS 2.0.6.1 - Privilege Escalation | fiyo cms | 8.8 (v3.0) | High |
| CVE-2017-9810 | Kaspersky Anti-Virus File Server 8.0.3.297 - Multiple Vulnerabilities | anti-virus for linux server | 8.8 (v3.0) | High |
| CVE-2019-9189 | Prima Access Control 2.3.35 - Arbitrary File Upload | flexair | 8.8 (v3.0) | High |
| CVE-2020-7246 | qdPM 9.1 Authenticated Arbitrary PHP File Upload (RCE) | qdpm | 8.8 (v3.1) | High |
| CVE-2020-8163 | Ruby on Rails <5.0.1 - Remote Code Execution | rails | 8.8 (v3.1) | High |
| CVE-2025-34510 | Sitecore XP CVE-2025-34510 Post-Authentication Remote Code Execution | experience commerce | 8.8 (v3.1) | High |
| CVE-2025-34097 | ProcessMaker Plugin Upload | ProcessMaker | 8.6 (v4.0) | High |
| CVE-2014-3120 | ElasticSearch Remote Code Execution (CVE-2014-3120) | elasticsearch | 8.1 (v3.1) | High |
| CVE-2018-1000130 | Jolokia Agent - JNDI Code Injection | webarchive agent | 8.1 (v3.0) | High |
| CVE-2025-6204 | DELMIA Apriso - Command Injection | delmia apriso | 8.0 (v3.1) | High |
| CVE-2014-0644 | EMC CTA v10.0 Unauthenticated XXE Arbitrary File Read | cloud tiering appliance software | 7.8 (v2.0) | High |
| CVE-2003-0822 | MS03-051 Microsoft IIS ISAPI FrontPage fp30reg.dll Chunked Overflow | frontpage server extensions | 7.5 (v2.0) | High |
| CVE-2014-9215 | PBBoard CMS 3.0.1 - SQL Injection | pbboard | 7.5 (v2.0) | High |
| CVE-2015-1518 | RedaxScript CMS 2.2.0 - SQL Injection | redaxscript | 7.5 (v2.0) | High |
| CVE-2015-2080 | Inductive Automation Ignition 7.8.1 - Remote Leakage Of Shared Buffers | fedora | 7.5 (v3.0) | High |
| CVE-2015-2824 | WordPress Plugin Simple Ads Manager - Multiple SQL Injections | simple ads manager | 7.5 (v2.0) | High |
| CVE-2017-9812 | Kaspersky Anti-Virus File Server 8.0.3.297 - Multiple Vulnerabilities | anti-virus for linux server | 7.5 (v3.0) | High |
| CVE-2018-7448 | CMS Made Simple 2.1.6 - Remote Code Execution | cms made simple | 7.5 (v3.0) | High |
| CVE-2023-2825 | GitLab Authenticated File Read | gitlab | 7.5 (v3.1) | High |
| CVE-2016-0709 | Apache Jetspeed Arbitrary File Upload | jetspeed | 7.2 (v3.0) | High |
| CVE-2019-1936 | Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities | integrated management controller supervisor | 7.2 (v3.1) | High |
| CVE-2013-5093 | Graphite Web Unsafe Pickle Handling | graphite | 6.8 (v2.0) | Medium |
| CVE-2017-6338 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilities | interscan web security virtual appliance | 6.5 (v3.0) | Medium |
| CVE-2017-6339 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilities | interscan web security virtual appliance | 6.5 (v3.0) | Medium |
| CVE-2017-9813 | Kaspersky Anti-Virus File Server 8.0.3.297 - Multiple Vulnerabilities | anti-virus for linux server | 6.1 (v3.0) | Medium |
| CVE-2017-6340 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilities | interscan web security virtual appliance | 5.4 (v3.0) | Medium |
| CVE-2015-5531 | ElasticSearch Arbitrary File Upload (WooYun-2015-110216) | elasticsearch | 5.0 (v2.0) | Medium |
| CVE-2020-35241 | Flatpress Add Blog 1.0.3 - Persistent Cross-Site Scripting | flatpress | 4.8 (v3.1) | Medium |
| CVE-2014-3110 | Honeywell XL Web Controller - Cross-Site Scripting | falcon xlweb linux controller | 4.3 (v2.0) | Medium |
| CVE-2015-4040 | F5 Big-IP 10.2.4 Build 595.0 Hotfix HF3 - Directory Traversal | enterprise manager | 4.0 (v2.0) | Medium |
| CVE-2013-5759 | Yealink VoIP Phone SIP-T38G - Privilege Escalation | - | N/A | N/A |
Observed CWEs
These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.