Atomicorp WAF Rule 393134

Rule Summary

• Rule ID: 393134
• Status: Active
• Alert message: Atomicorp.com WAF Rules - Virtual Just In Time Patch: Test.fcgi or test.cgi access
• Observed CWEs: CWE-78 (1)
• Revision: 1
• Rule severity: Critical (2)
• Phase: 2 (request body)
• Request surfaces: Request URI
• Rule action: deny
• HTTP status: 403
• Logging: log, auditlog

Description

This rules detects access to either the test.cgi or test.fcgi scripts.

Some versions of test scripts contain serious security vulnerabilities that allow attackers to compromise the system. Specifically, the test.cgi and test.fcgi scripts are known examples of this, and have been used by attackers for decades to compromise vulnerable systems.

These scripts can also be used to carry out recon attacks on the system, listing files, system configurations and gathering other information attackers can use to compromise the system.

This by itself may not be an attack if this action is being carried out by a trusted user.

Troubleshooting

False Positives

A false positive can occur when a request legitimately uses this web application. If you want to allow the use of this script, simply disable this rule.

If you believe this is a false positive, first check to see if the request was for “test.cgi” or “test.fcgi”. If it was, then this is not a false positive. The rule is performing exactly as intended. If you wish to allow access to this script, simply disable this rule.

If the request was not for “test.cgi” or “test.fcgi”, please report this to our security team to determine if this is a legitimate case, or if its clever attack on your system. If it is a false positive, we will fix the issue in the rules and get a release out to you promptly.

Tuning Guidance

Please see the Tuning the Atomicorp WAF Rules page for basic information.

Selected Related CVEs

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

Observed CWEs

These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.

Documentation Source

• Original wiki page: WAF 393134
• Source revision: 5392
• Source revision date: 2015-02-27