On this page
Atomicorp WAF Rule 390724
Rule Summary
- Rule ID: 390724
- Status: Active
- Alert message: Atomicorp.com WAF Rules: HTTP ARGS Injection Attack via payload (CR/LF detected)
- Observed CWEs: CWE-20 (3), CWE-22 (2), CWE-74 (1), CWE-78 (2), CWE-79 (4), CWE-89 (6), CWE-94 (2), CWE-120 (1), CWE-200 (2), CWE-255 (1), CWE-269 (1), CWE-284 (1), CWE-287 (1), CWE-294 (1), CWE-352 (1), CWE-434 (1), CWE-502 (1), CWE-521 (1), CWE-732 (1), CWE-798 (1), CWE-862 (1)
- Rule severity: Alert (1)
- Phase: 2 (request body)
- Request surfaces: Request argument names, JSON request data, SOAP request data
- Rule action: deny
- HTTP status: 403
- Public tags: attack-protocol
- Logging: log, auditlog
Description
This rule detects behavior identified by its current alert as “HTTP ARGS Injection Attack via payload (CR/LF detected)” in the request argument names, JSON request data, SOAP request data. It evaluates during the request body phase and denies matching traffic with HTTP status 403.
Selected Related CVEs
This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.
| CVE | Vulnerability | Product | CVSS | Severity |
|---|---|---|---|---|
| CVE-2013-5755 | Yealink VoIP Phone SIP-T38G - Remote Command Execution | sip-t38g | 10.0 (v2.0) | High |
| CVE-2025-45854 | JEHC-BPM - Remote Code Execute | jehc-bpm | 10.0 (v3.1) | Critical |
| CVE-2015-1427 | ElasticSearch - Remote Code Execution | elasticsearch | 9.8 (v3.1) | Critical |
| CVE-2015-3933 | GeniXCMS 0.0.3 - 'register.php' SQL Injection | genixcms | 9.8 (v3.0) | Critical |
| CVE-2017-16935 | Ametys CMS 4.0.2 - Password Reset | ametys | 9.8 (v3.0) | Critical |
| CVE-2017-17999 | RISE 1.9 - 'search' SQL Injection | rise ultimate project manager | 9.8 (v3.0) | Critical |
| CVE-2017-9811 | Kaspersky Anti-Virus File Server 8.0.3.297 - Multiple Vulnerabilities | anti-virus for linux server | 9.8 (v3.0) | Critical |
| CVE-2019-17564 | Apache Dubbo 2.5.x-2.7.4 - Insecure Deserialization | dubbo | 9.8 (v3.1) | Critical |
| CVE-2019-1935 | Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities | integrated management controller supervisor | 9.8 (v3.1) | Critical |
| CVE-2019-1937 | Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities | integrated management controller supervisor | 9.8 (v3.0) | Critical |
| CVE-2020-11984 | Apache HTTP Server - Remote Code Execution | http server | 9.8 (v3.1) | Critical |
| CVE-2021-42325 | Froxlor 0.10.29.1 - SQL Injection (Authenticated) | froxlor | 9.8 (v3.1) | Critical |
| CVE-2023-47246 | SysAid Server - Remote Code Execution | sysaid on-premises | 9.8 (v3.1) | Critical |
| CVE-2013-5758 | Yealink VoIP Phone SIP-T38G - Privilege Escalation | sip-t38g | 9.0 (v2.0) | High |
| CVE-2017-6823 | Fiyo CMS 2.0.6.1 - Privilege Escalation | fiyo cms | 8.8 (v3.0) | High |
| CVE-2017-9810 | Kaspersky Anti-Virus File Server 8.0.3.297 - Multiple Vulnerabilities | anti-virus for linux server | 8.8 (v3.0) | High |
| CVE-2019-9189 | Prima Access Control 2.3.35 - Arbitrary File Upload | flexair | 8.8 (v3.0) | High |
| CVE-2020-8163 | Ruby on Rails <5.0.1 - Remote Code Execution | rails | 8.8 (v3.1) | High |
| CVE-2014-3120 | ElasticSearch v1.1.1/1.2 RCE | elasticsearch | 8.1 (v3.1) | High |
| CVE-2018-1000130 | Jolokia Agent - JNDI Code Injection | webarchive agent | 8.1 (v3.0) | High |
| CVE-2025-6204 | DELMIA Apriso - Command Injection | delmia apriso | 8.0 (v3.1) | High |
| CVE-2014-9215 | PBBoard CMS 3.0.1 - SQL Injection | pbboard | 7.5 (v2.0) | High |
| CVE-2015-1518 | RedaxScript CMS 2.2.0 - SQL Injection | redaxscript | 7.5 (v2.0) | High |
| CVE-2015-2080 | Inductive Automation Ignition 7.8.1 - Remote Leakage Of Shared Buffers | fedora | 7.5 (v3.0) | High |
| CVE-2015-2824 | WordPress Plugin Simple Ads Manager - Multiple SQL Injections | simple ads manager | 7.5 (v2.0) | High |
| CVE-2017-9812 | Kaspersky Anti-Virus File Server 8.0.3.297 - Multiple Vulnerabilities | anti-virus for linux server | 7.5 (v3.0) | High |
| CVE-2018-7448 | CMS Made Simple 2.1.6 - Remote Code Execution | cms made simple | 7.5 (v3.0) | High |
| CVE-2019-1936 | Cisco UCS Director_ Cisco Integrated Management Controller Supervisor and Cisco UCS Director Express for Big Data - Multiple Vulnerabilities | integrated management controller supervisor | 7.2 (v3.1) | High |
| CVE-2017-6338 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilities | interscan web security virtual appliance | 6.5 (v3.0) | Medium |
| CVE-2017-6339 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilities | interscan web security virtual appliance | 6.5 (v3.0) | Medium |
| CVE-2017-9813 | Kaspersky Anti-Virus File Server 8.0.3.297 - Multiple Vulnerabilities | anti-virus for linux server | 6.1 (v3.0) | Medium |
| CVE-2017-6340 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilities | interscan web security virtual appliance | 5.4 (v3.0) | Medium |
| CVE-2020-35241 | Flatpress Add Blog 1.0.3 - Persistent Cross-Site Scripting | flatpress | 4.8 (v3.1) | Medium |
| CVE-2014-3110 | Honeywell XL Web Controller - Cross-Site Scripting | falcon xlweb linux controller | 4.3 (v2.0) | Medium |
| CVE-2015-4040 | F5 Big-IP 10.2.4 Build 595.0 Hotfix HF3 - Directory Traversal | enterprise manager | 4.0 (v2.0) | Medium |
| CVE-2013-5759 | Yealink VoIP Phone SIP-T38G - Privilege Escalation | - | N/A | N/A |
Observed CWEs
These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.