@abtnode/router-provider 1.16.45 → 1.16.46-beta-20250703-050038-4ba2582f

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (34) hide show
  1. package/lib/nginx/includes/security/crs4/rules/REQUEST-901-INITIALIZATION.conf +42 -40
  2. package/lib/nginx/includes/security/crs4/rules/REQUEST-905-COMMON-EXCEPTIONS.conf +4 -4
  3. package/lib/nginx/includes/security/crs4/rules/REQUEST-911-METHOD-ENFORCEMENT.conf +12 -11
  4. package/lib/nginx/includes/security/crs4/rules/REQUEST-913-SCANNER-DETECTION.conf +12 -11
  5. package/lib/nginx/includes/security/crs4/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf +127 -148
  6. package/lib/nginx/includes/security/crs4/rules/REQUEST-921-PROTOCOL-ATTACK.conf +80 -35
  7. package/lib/nginx/includes/security/crs4/rules/REQUEST-922-MULTIPART-ATTACK.conf +12 -6
  8. package/lib/nginx/includes/security/crs4/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf +22 -17
  9. package/lib/nginx/includes/security/crs4/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf +20 -15
  10. package/lib/nginx/includes/security/crs4/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf +254 -86
  11. package/lib/nginx/includes/security/crs4/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf +172 -65
  12. package/lib/nginx/includes/security/crs4/rules/REQUEST-934-APPLICATION-ATTACK-GENERIC.conf +65 -29
  13. package/lib/nginx/includes/security/crs4/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf +114 -78
  14. package/lib/nginx/includes/security/crs4/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf +182 -120
  15. package/lib/nginx/includes/security/crs4/rules/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.conf +19 -16
  16. package/lib/nginx/includes/security/crs4/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf +48 -34
  17. package/lib/nginx/includes/security/crs4/rules/REQUEST-949-BLOCKING-EVALUATION.conf +30 -30
  18. package/lib/nginx/includes/security/crs4/rules/RESPONSE-950-DATA-LEAKAGES.conf +20 -15
  19. package/lib/nginx/includes/security/crs4/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf +47 -29
  20. package/lib/nginx/includes/security/crs4/rules/RESPONSE-952-DATA-LEAKAGES-JAVA.conf +15 -36
  21. package/lib/nginx/includes/security/crs4/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf +20 -15
  22. package/lib/nginx/includes/security/crs4/rules/RESPONSE-954-DATA-LEAKAGES-IIS.conf +22 -17
  23. package/lib/nginx/includes/security/crs4/rules/RESPONSE-955-WEB-SHELLS.conf +92 -43
  24. package/lib/nginx/includes/security/crs4/rules/RESPONSE-959-BLOCKING-EVALUATION.conf +30 -30
  25. package/lib/nginx/includes/security/crs4/rules/RESPONSE-980-CORRELATION.conf +23 -23
  26. package/lib/nginx/includes/security/crs4/rules/java-classes.data +11 -0
  27. package/lib/nginx/includes/security/crs4/rules/lfi-os-files.data +227 -15
  28. package/lib/nginx/includes/security/crs4/rules/php-function-names-933150.data +0 -7
  29. package/lib/nginx/includes/security/crs4/rules/restricted-files.data +250 -29
  30. package/lib/nginx/includes/security/crs4/rules/restricted-upload.data +200 -26
  31. package/lib/nginx/includes/security/crs4/rules/unix-shell-builtins.data +20 -0
  32. package/lib/nginx/includes/security/crs4/rules/unix-shell.data +39 -18
  33. package/lib/nginx/includes/security/crs4/rules/web-shells-asp.data +23 -0
  34. package/package.json +7 -7
package/lib/nginx/includes/security/crs4/rules/RESPONSE-950-DATA-LEAKAGES.conf CHANGED
@@ -1,7 +1,7 @@
1
1
  # ------------------------------------------------------------------------
2
- # OWASP CRS ver.4.9.0
2
+ # OWASP CRS ver.4.16.0
3
3
  # Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
4
- # Copyright (c) 2021-2024 CRS project. All rights reserved.
4
+ # Copyright (c) 2021-2025 CRS project. All rights reserved.
5
5
  #
6
6
  # The OWASP CRS is distributed under
7
7
  # Apache Software License (ASL) version 2
@@ -28,7 +28,8 @@ SecRule TX:crs_skip_response_analysis "@eq 1" \
28
28
  pass,\
29
29
  nolog,\
30
30
  tag:'OWASP_CRS',\
31
- ver:'OWASP_CRS/4.9.0',\
31
+ tag:'OWASP_CRS/DATA-LEAKAGES',\
32
+ ver:'OWASP_CRS/4.16.0',\
32
33
  skipAfter:END-RESPONSE-959-BLOCKING-EVALUATION"
33
34
 
34
35
  # Skip all rules if RESPONSE_BODY is compressed.
@@ -38,11 +39,12 @@ SecRule RESPONSE_HEADERS:Content-Encoding "@pm gzip compress deflate br zstd" \
38
39
  pass,\
39
40
  nolog,\
40
41
  tag:'OWASP_CRS',\
41
- ver:'OWASP_CRS/4.9.0',\
42
+ tag:'OWASP_CRS/DATA-LEAKAGES',\
43
+ ver:'OWASP_CRS/4.16.0',\
42
44
  skipAfter:END-RESPONSE-950-DATA-LEAKAGES"
43
45
 
44
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:950011,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-950-DATA-LEAKAGES"
45
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:950012,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-950-DATA-LEAKAGES"
46
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:950011,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-950-DATA-LEAKAGES"
47
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:950012,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-950-DATA-LEAKAGES"
46
48
  #
47
49
  # -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)
48
50
  #
@@ -64,9 +66,10 @@ SecRule RESPONSE_BODY "@rx (?:<(?:TITLE>Index of.*?<H|title>Index of.*?<h)1>Inde
64
66
  tag:'attack-disclosure',\
65
67
  tag:'paranoia-level/1',\
66
68
  tag:'OWASP_CRS',\
69
+ tag:'OWASP_CRS/DATA-LEAKAGES',\
67
70
  tag:'capec/1000/118/116/54/127',\
68
71
  tag:'PCI/6.5.6',\
69
- ver:'OWASP_CRS/4.9.0',\
72
+ ver:'OWASP_CRS/4.16.0',\
70
73
  severity:'ERROR',\
71
74
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}'"
72
75
 
@@ -96,15 +99,16 @@ SecRule RESPONSE_BODY "@rx ^#\!\s?/" \
96
99
  tag:'attack-disclosure',\
97
100
  tag:'paranoia-level/1',\
98
101
  tag:'OWASP_CRS',\
102
+ tag:'OWASP_CRS/DATA-LEAKAGES',\
99
103
  tag:'capec/1000/118/116',\
100
104
  tag:'PCI/6.5.6',\
101
- ver:'OWASP_CRS/4.9.0',\
105
+ ver:'OWASP_CRS/4.16.0',\
102
106
  severity:'ERROR',\
103
107
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}'"
104
108
 
105
109
 
106
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:950013,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-950-DATA-LEAKAGES"
107
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:950014,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-950-DATA-LEAKAGES"
110
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:950013,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-950-DATA-LEAKAGES"
111
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:950014,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-950-DATA-LEAKAGES"
108
112
  #
109
113
  # -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)
110
114
  #
@@ -126,24 +130,25 @@ SecRule RESPONSE_STATUS "@rx ^5\d{2}$" \
126
130
  tag:'attack-disclosure',\
127
131
  tag:'paranoia-level/2',\
128
132
  tag:'OWASP_CRS',\
133
+ tag:'OWASP_CRS/DATA-LEAKAGES',\
129
134
  tag:'capec/1000/152',\
130
135
  tag:'PCI/6.5.6',\
131
- ver:'OWASP_CRS/4.9.0',\
136
+ ver:'OWASP_CRS/4.16.0',\
132
137
  severity:'ERROR',\
133
138
  setvar:'tx.outbound_anomaly_score_pl2=+%{tx.error_anomaly_score}'"
134
139
 
135
140
 
136
141
 
137
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:950015,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-950-DATA-LEAKAGES"
138
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:950016,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-950-DATA-LEAKAGES"
142
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:950015,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-950-DATA-LEAKAGES"
143
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:950016,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-950-DATA-LEAKAGES"
139
144
  #
140
145
  # -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)
141
146
  #
142
147
 
143
148
 
144
149
 
145
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:950017,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-950-DATA-LEAKAGES"
146
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:950018,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-950-DATA-LEAKAGES"
150
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:950017,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-950-DATA-LEAKAGES"
151
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:950018,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-950-DATA-LEAKAGES"
147
152
  #
148
153
  # -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)
149
154
  #
package/lib/nginx/includes/security/crs4/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf CHANGED
@@ -1,7 +1,7 @@
1
1
  # ------------------------------------------------------------------------
2
- # OWASP CRS ver.4.9.0
2
+ # OWASP CRS ver.4.16.0
3
3
  # Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
4
- # Copyright (c) 2021-2024 CRS project. All rights reserved.
4
+ # Copyright (c) 2021-2025 CRS project. All rights reserved.
5
5
  #
6
6
  # The OWASP CRS is distributed under
7
7
  # Apache Software License (ASL) version 2
@@ -19,11 +19,12 @@ SecRule RESPONSE_HEADERS:Content-Encoding "@pm gzip compress deflate br zstd" \
19
19
  pass,\
20
20
  nolog,\
21
21
  tag:'OWASP_CRS',\
22
- ver:'OWASP_CRS/4.9.0',\
22
+ tag:'OWASP_CRS/DATA-LEAKAGES-SQL',\
23
+ ver:'OWASP_CRS/4.16.0',\
23
24
  skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL"
24
25
 
25
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:951011,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL"
26
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:951012,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL"
26
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:951011,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL"
27
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:951012,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL"
27
28
  #
28
29
  # -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)
29
30
  #
@@ -45,8 +46,9 @@ SecRule RESPONSE_BODY "!@pmFromFile sql-errors.data" \
45
46
  tag:'platform-multi',\
46
47
  tag:'attack-disclosure',\
47
48
  tag:'OWASP_CRS',\
49
+ tag:'OWASP_CRS/DATA-LEAKAGES-SQL',\
48
50
  tag:'capec/1000/118/116/54',\
49
- ver:'OWASP_CRS/4.9.0',\
51
+ ver:'OWASP_CRS/4.16.0',\
50
52
  skipAfter:END-SQL-ERROR-MATCH-PL1"
51
53
 
52
54
  SecRule RESPONSE_BODY "@rx (?i:JET Database Engine|Access Database Engine|\[Microsoft\]\[ODBC Microsoft Access Driver\])" \
@@ -63,8 +65,9 @@ SecRule RESPONSE_BODY "@rx (?i:JET Database Engine|Access Database Engine|\[Micr
63
65
  tag:'attack-disclosure',\
64
66
  tag:'paranoia-level/1',\
65
67
  tag:'OWASP_CRS',\
68
+ tag:'OWASP_CRS/DATA-LEAKAGES-SQL',\
66
69
  tag:'capec/1000/118/116/54',\
67
- ver:'OWASP_CRS/4.9.0',\
70
+ ver:'OWASP_CRS/4.16.0',\
68
71
  severity:'CRITICAL',\
69
72
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
70
73
  setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
@@ -88,8 +91,9 @@ SecRule RESPONSE_BODY "@rx (?i)\bORA-[0-9][0-9][0-9][0-9][0-9]:|java\.sql\.SQLEx
88
91
  tag:'attack-disclosure',\
89
92
  tag:'paranoia-level/1',\
90
93
  tag:'OWASP_CRS',\
94
+ tag:'OWASP_CRS/DATA-LEAKAGES-SQL',\
91
95
  tag:'capec/1000/118/116/54',\
92
- ver:'OWASP_CRS/4.9.0',\
96
+ ver:'OWASP_CRS/4.16.0',\
93
97
  severity:'CRITICAL',\
94
98
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
95
99
  setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
@@ -108,8 +112,9 @@ SecRule RESPONSE_BODY "@rx (?i:DB2 SQL error:|\[IBM\]\[CLI Driver\]\[DB2/6000\]|
108
112
  tag:'attack-disclosure',\
109
113
  tag:'paranoia-level/1',\
110
114
  tag:'OWASP_CRS',\
115
+ tag:'OWASP_CRS/DATA-LEAKAGES-SQL',\
111
116
  tag:'capec/1000/118/116/54',\
112
- ver:'OWASP_CRS/4.9.0',\
117
+ ver:'OWASP_CRS/4.16.0',\
113
118
  severity:'CRITICAL',\
114
119
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
115
120
  setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
@@ -128,8 +133,9 @@ SecRule RESPONSE_BODY "@rx (?i:\[DM_QUERY_E_SYNTAX\]|has occurred in the vicinit
128
133
  tag:'attack-disclosure',\
129
134
  tag:'paranoia-level/1',\
130
135
  tag:'OWASP_CRS',\
136
+ tag:'OWASP_CRS/DATA-LEAKAGES-SQL',\
131
137
  tag:'capec/1000/118/116/54',\
132
- ver:'OWASP_CRS/4.9.0',\
138
+ ver:'OWASP_CRS/4.16.0',\
133
139
  severity:'CRITICAL',\
134
140
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
135
141
  setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
@@ -148,8 +154,9 @@ SecRule RESPONSE_BODY "@rx (?i)Dynamic SQL Error" \
148
154
  tag:'attack-disclosure',\
149
155
  tag:'paranoia-level/1',\
150
156
  tag:'OWASP_CRS',\
157
+ tag:'OWASP_CRS/DATA-LEAKAGES-SQL',\
151
158
  tag:'capec/1000/118/116/54',\
152
- ver:'OWASP_CRS/4.9.0',\
159
+ ver:'OWASP_CRS/4.16.0',\
153
160
  severity:'CRITICAL',\
154
161
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
155
162
  setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
@@ -168,8 +175,9 @@ SecRule RESPONSE_BODY "@rx (?i)Exception (?:condition )?\d+\. Transaction rollba
168
175
  tag:'attack-disclosure',\
169
176
  tag:'paranoia-level/1',\
170
177
  tag:'OWASP_CRS',\
178
+ tag:'OWASP_CRS/DATA-LEAKAGES-SQL',\
171
179
  tag:'capec/1000/118/116/54',\
172
- ver:'OWASP_CRS/4.9.0',\
180
+ ver:'OWASP_CRS/4.16.0',\
173
181
  severity:'CRITICAL',\
174
182
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
175
183
  setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
@@ -188,8 +196,9 @@ SecRule RESPONSE_BODY "@rx (?i)org\.hsqldb\.jdbc" \
188
196
  tag:'attack-disclosure',\
189
197
  tag:'paranoia-level/1',\
190
198
  tag:'OWASP_CRS',\
199
+ tag:'OWASP_CRS/DATA-LEAKAGES-SQL',\
191
200
  tag:'capec/1000/118/116/54',\
192
- ver:'OWASP_CRS/4.9.0',\
201
+ ver:'OWASP_CRS/4.16.0',\
193
202
  severity:'CRITICAL',\
194
203
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
195
204
  setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
@@ -208,8 +217,9 @@ SecRule RESPONSE_BODY "@rx (?i:An illegal character has been found in the statem
208
217
  tag:'attack-disclosure',\
209
218
  tag:'paranoia-level/1',\
210
219
  tag:'OWASP_CRS',\
220
+ tag:'OWASP_CRS/DATA-LEAKAGES-SQL',\
211
221
  tag:'capec/1000/118/116/54',\
212
- ver:'OWASP_CRS/4.9.0',\
222
+ ver:'OWASP_CRS/4.16.0',\
213
223
  severity:'CRITICAL',\
214
224
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
215
225
  setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
@@ -228,8 +238,9 @@ SecRule RESPONSE_BODY "@rx (?i:Warning.*ingres_|Ingres SQLSTATE|Ingres\W.*Driver
228
238
  tag:'attack-disclosure',\
229
239
  tag:'paranoia-level/1',\
230
240
  tag:'OWASP_CRS',\
241
+ tag:'OWASP_CRS/DATA-LEAKAGES-SQL',\
231
242
  tag:'capec/1000/118/116/54',\
232
- ver:'OWASP_CRS/4.9.0',\
243
+ ver:'OWASP_CRS/4.16.0',\
233
244
  severity:'CRITICAL',\
234
245
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
235
246
  setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
@@ -248,8 +259,9 @@ SecRule RESPONSE_BODY "@rx (?i:<b>Warning</b>: ibase_|Unexpected end of command
248
259
  tag:'attack-disclosure',\
249
260
  tag:'paranoia-level/1',\
250
261
  tag:'OWASP_CRS',\
262
+ tag:'OWASP_CRS/DATA-LEAKAGES-SQL',\
251
263
  tag:'capec/1000/118/116/54',\
252
- ver:'OWASP_CRS/4.9.0',\
264
+ ver:'OWASP_CRS/4.16.0',\
253
265
  severity:'CRITICAL',\
254
266
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
255
267
  setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
@@ -268,13 +280,14 @@ SecRule RESPONSE_BODY "@rx (?i:SQL error.*POS[0-9]+.*|Warning.*maxdb.*)" \
268
280
  tag:'attack-disclosure',\
269
281
  tag:'paranoia-level/1',\
270
282
  tag:'OWASP_CRS',\
283
+ tag:'OWASP_CRS/DATA-LEAKAGES-SQL',\
271
284
  tag:'capec/1000/118/116/54',\
272
- ver:'OWASP_CRS/4.9.0',\
285
+ ver:'OWASP_CRS/4.16.0',\
273
286
  severity:'CRITICAL',\
274
287
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
275
288
  setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
276
289
 
277
- SecRule RESPONSE_BODY "@rx (?i)(?:System\.Data\.OleDb\.OleDbException|\[Microsoft\]\[ODBC SQL Server Driver\]|\[Macromedia\]\[SQLServer JDBC Driver\]|\[SqlException|System\.Data\.SqlClient\.SqlException|Unclosed quotation mark after the character string|'80040e14'|mssql_query\(\)|Microsoft OLE DB Provider for ODBC Drivers|Microsoft OLE DB Provider for SQL Server|Incorrect syntax near|Sintaxis incorrecta cerca de|Syntax error in string in query expression|Procedure or function .* expects parameter|Unclosed quotation mark before the character string|Syntax error .* in query expression|Data type mismatch in criteria expression\.|ADODB\.Field \(0x800A0BCD\)|the used select statements have different number of columns|OLE DB.*SQL Server|Warning.*mssql_.*|Driver.*SQL[ _-]*Server|SQL Server.*Driver|SQL Server.*[0-9a-fA-F]{8}|Exception.*\WSystem\.Data\.SqlClient\.|Conversion failed when converting the varchar value .*? to data type int\.)" \
290
+ SecRule RESPONSE_BODY "@rx (?i)(?:System\.Data\.OleDb\.OleDbException|\[Microsoft\]\[ODBC SQL Server Driver\]|\[Macromedia\]\[SQLServer JDBC Driver\]|\[SqlException|System\.Data\.SqlClient\.SqlException|Unclosed quotation mark after the character string|'80040e14'|mssql_query\(\)|Microsoft OLE DB Provider for ODBC Drivers|Microsoft OLE DB Provider for SQL Server|Incorrect syntax near|Sintaxis incorrecta cerca de|Syntax error in string in query expression|Procedure or function '.{1,128}' expects parameter|Unclosed quotation mark before the character string|Syntax error .* in query expression|Data type mismatch in criteria expression\.|ADODB\.Field \(0x800A0BCD\)|the used select statements have different number of columns|OLE DB.*SQL Server|Warning.*mssql_.*|Driver.*SQL[ _-]*Server|Exception.*\WSystem\.Data\.SqlClient\.|Conversion failed when converting the varchar value .*? to data type int\.)" \
278
291
  "id:951220,\
279
292
  phase:4,\
280
293
  block,\
@@ -288,8 +301,9 @@ SecRule RESPONSE_BODY "@rx (?i)(?:System\.Data\.OleDb\.OleDbException|\[Microsof
288
301
  tag:'attack-disclosure',\
289
302
  tag:'paranoia-level/1',\
290
303
  tag:'OWASP_CRS',\
304
+ tag:'OWASP_CRS/DATA-LEAKAGES-SQL',\
291
305
  tag:'capec/1000/118/116/54',\
292
- ver:'OWASP_CRS/4.9.0',\
306
+ ver:'OWASP_CRS/4.16.0',\
293
307
  severity:'CRITICAL',\
294
308
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
295
309
  setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
@@ -313,8 +327,9 @@ SecRule RESPONSE_BODY "@rx (?i)(?:supplied argument is not a valid |SQL syntax.*
313
327
  tag:'attack-disclosure',\
314
328
  tag:'paranoia-level/1',\
315
329
  tag:'OWASP_CRS',\
330
+ tag:'OWASP_CRS/DATA-LEAKAGES-SQL',\
316
331
  tag:'capec/1000/118/116/54',\
317
- ver:'OWASP_CRS/4.9.0',\
332
+ ver:'OWASP_CRS/4.16.0',\
318
333
  severity:'CRITICAL',\
319
334
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
320
335
  setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
@@ -338,8 +353,9 @@ SecRule RESPONSE_BODY "@rx (?i)P(?:ostgreSQL(?: query failed:|.{1,20}ERROR)|G::[
338
353
  tag:'attack-disclosure',\
339
354
  tag:'paranoia-level/1',\
340
355
  tag:'OWASP_CRS',\
356
+ tag:'OWASP_CRS/DATA-LEAKAGES-SQL',\
341
357
  tag:'capec/1000/118/116/54',\
342
- ver:'OWASP_CRS/4.9.0',\
358
+ ver:'OWASP_CRS/4.16.0',\
343
359
  severity:'CRITICAL',\
344
360
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
345
361
  setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
@@ -358,8 +374,9 @@ SecRule RESPONSE_BODY "@rx (?i)(?:Warning.*sqlite_.*|Warning.*SQLite3::|SQLite/J
358
374
  tag:'attack-disclosure',\
359
375
  tag:'paranoia-level/1',\
360
376
  tag:'OWASP_CRS',\
377
+ tag:'OWASP_CRS/DATA-LEAKAGES-SQL',\
361
378
  tag:'capec/1000/118/116/54',\
362
- ver:'OWASP_CRS/4.9.0',\
379
+ ver:'OWASP_CRS/4.16.0',\
363
380
  severity:'CRITICAL',\
364
381
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
365
382
  setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
@@ -378,8 +395,9 @@ SecRule RESPONSE_BODY "@rx (?i)(?:Sybase message:|Warning.{2,20}sybase|Sybase.*S
378
395
  tag:'attack-disclosure',\
379
396
  tag:'paranoia-level/1',\
380
397
  tag:'OWASP_CRS',\
398
+ tag:'OWASP_CRS/DATA-LEAKAGES-SQL',\
381
399
  tag:'capec/1000/118/116/54',\
382
- ver:'OWASP_CRS/4.9.0',\
400
+ ver:'OWASP_CRS/4.16.0',\
383
401
  severity:'CRITICAL',\
384
402
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
385
403
  setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
@@ -387,24 +405,24 @@ SecRule RESPONSE_BODY "@rx (?i)(?:Sybase message:|Warning.{2,20}sybase|Sybase.*S
387
405
  SecMarker "END-SQL-ERROR-MATCH-PL1"
388
406
 
389
407
 
390
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:951013,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL"
391
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:951014,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL"
408
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:951013,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL"
409
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:951014,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL"
392
410
  #
393
411
  # -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)
394
412
  #
395
413
 
396
414
 
397
415
 
398
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:951015,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL"
399
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:951016,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL"
416
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:951015,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL"
417
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:951016,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL"
400
418
  #
401
419
  # -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)
402
420
  #
403
421
 
404
422
 
405
423
 
406
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:951017,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL"
407
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:951018,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL"
424
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:951017,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL"
425
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:951018,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL"
408
426
  #
409
427
  # -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)
410
428
  #
package/lib/nginx/includes/security/crs4/rules/RESPONSE-952-DATA-LEAKAGES-JAVA.conf CHANGED
@@ -1,7 +1,7 @@
1
1
  # ------------------------------------------------------------------------
2
- # OWASP CRS ver.4.9.0
2
+ # OWASP CRS ver.4.16.0
3
3
  # Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
4
- # Copyright (c) 2021-2024 CRS project. All rights reserved.
4
+ # Copyright (c) 2021-2025 CRS project. All rights reserved.
5
5
  #
6
6
  # The OWASP CRS is distributed under
7
7
  # Apache Software License (ASL) version 2
@@ -19,44 +19,22 @@ SecRule RESPONSE_HEADERS:Content-Encoding "@pm gzip compress deflate br zstd" \
19
19
  pass,\
20
20
  nolog,\
21
21
  tag:'OWASP_CRS',\
22
- ver:'OWASP_CRS/4.9.0',\
22
+ tag:'OWASP_CRS/DATA-LEAKAGES-JAVA',\
23
+ ver:'OWASP_CRS/4.16.0',\
23
24
  skipAfter:END-RESPONSE-952-DATA-LEAKAGES-JAVA"
24
25
 
25
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:952011,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-952-DATA-LEAKAGES-JAVA"
26
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:952012,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-952-DATA-LEAKAGES-JAVA"
26
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:952011,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-952-DATA-LEAKAGES-JAVA"
27
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:952012,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-952-DATA-LEAKAGES-JAVA"
27
28
  #
28
29
  # -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)
29
30
  #
30
31
 
31
- #
32
- # -=[ Java Source Code Leakages ]=-
33
- #
34
- SecRule RESPONSE_BODY "@pmFromFile java-code-leakages.data" \
35
- "id:952100,\
36
- phase:4,\
37
- block,\
38
- capture,\
39
- t:none,\
40
- msg:'Java Source Code Leakage',\
41
- logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
42
- tag:'application-multi',\
43
- tag:'language-java',\
44
- tag:'platform-multi',\
45
- tag:'attack-disclosure',\
46
- tag:'paranoia-level/1',\
47
- tag:'OWASP_CRS',\
48
- tag:'capec/1000/118/116',\
49
- tag:'PCI/6.5.6',\
50
- ver:'OWASP_CRS/4.9.0',\
51
- severity:'ERROR',\
52
- setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}'"
53
-
54
32
  #
55
33
  # -=[ Java Errors ]=-
56
34
  #
57
35
  # Ref: https://github.com/andresriancho/w3af/blob/master/w3af/plugins/grep/error_pages.py
58
36
  #
59
- SecRule RESPONSE_BODY "@pmFromFile java-errors.data" \
37
+ SecRule RESPONSE_BODY "@rx (?i)java[\.a-z]+E(?:xception|rror)|(?:org|com)\.[\.a-z]+Exception|Exception in thread \"[^\"]*\"|at[\s\x0b]+(?:ja(?:vax?|karta)|org|com)" \
60
38
  "id:952110,\
61
39
  phase:4,\
62
40
  block,\
@@ -70,32 +48,33 @@ SecRule RESPONSE_BODY "@pmFromFile java-errors.data" \
70
48
  tag:'attack-disclosure',\
71
49
  tag:'paranoia-level/1',\
72
50
  tag:'OWASP_CRS',\
51
+ tag:'OWASP_CRS/DATA-LEAKAGES-JAVA',\
73
52
  tag:'capec/1000/118/116',\
74
53
  tag:'PCI/6.5.6',\
75
- ver:'OWASP_CRS/4.9.0',\
54
+ ver:'OWASP_CRS/4.16.0',\
76
55
  severity:'ERROR',\
77
56
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}'"
78
57
 
79
58
 
80
59
 
81
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:952013,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-952-DATA-LEAKAGES-JAVA"
82
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:952014,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-952-DATA-LEAKAGES-JAVA"
60
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:952013,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-952-DATA-LEAKAGES-JAVA"
61
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:952014,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-952-DATA-LEAKAGES-JAVA"
83
62
  #
84
63
  # -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)
85
64
  #
86
65
 
87
66
 
88
67
 
89
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:952015,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-952-DATA-LEAKAGES-JAVA"
90
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:952016,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-952-DATA-LEAKAGES-JAVA"
68
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:952015,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-952-DATA-LEAKAGES-JAVA"
69
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:952016,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-952-DATA-LEAKAGES-JAVA"
91
70
  #
92
71
  # -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)
93
72
  #
94
73
 
95
74
 
96
75
 
97
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:952017,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-952-DATA-LEAKAGES-JAVA"
98
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:952018,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-952-DATA-LEAKAGES-JAVA"
76
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:952017,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-952-DATA-LEAKAGES-JAVA"
77
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:952018,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-952-DATA-LEAKAGES-JAVA"
99
78
  #
100
79
  # -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)
101
80
  #
package/lib/nginx/includes/security/crs4/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf CHANGED
@@ -1,7 +1,7 @@
1
1
  # ------------------------------------------------------------------------
2
- # OWASP CRS ver.4.9.0
2
+ # OWASP CRS ver.4.16.0
3
3
  # Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
4
- # Copyright (c) 2021-2024 CRS project. All rights reserved.
4
+ # Copyright (c) 2021-2025 CRS project. All rights reserved.
5
5
  #
6
6
  # The OWASP CRS is distributed under
7
7
  # Apache Software License (ASL) version 2
@@ -19,11 +19,12 @@ SecRule RESPONSE_HEADERS:Content-Encoding "@pm gzip compress deflate br zstd" \
19
19
  pass,\
20
20
  nolog,\
21
21
  tag:'OWASP_CRS',\
22
- ver:'OWASP_CRS/4.9.0',\
22
+ tag:'OWASP_CRS/DATA-LEAKAGES-PHP',\
23
+ ver:'OWASP_CRS/4.16.0',\
23
24
  skipAfter:END-RESPONSE-953-DATA-LEAKAGES-PHP"
24
25
 
25
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:953011,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-953-DATA-LEAKAGES-PHP"
26
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:953012,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-953-DATA-LEAKAGES-PHP"
26
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:953011,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-953-DATA-LEAKAGES-PHP"
27
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:953012,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-953-DATA-LEAKAGES-PHP"
27
28
  #
28
29
  # -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)
29
30
  #
@@ -45,9 +46,10 @@ SecRule RESPONSE_BODY "@pmFromFile php-errors.data" \
45
46
  tag:'attack-disclosure',\
46
47
  tag:'paranoia-level/1',\
47
48
  tag:'OWASP_CRS',\
49
+ tag:'OWASP_CRS/DATA-LEAKAGES-PHP',\
48
50
  tag:'capec/1000/118/116',\
49
51
  tag:'PCI/6.5.6',\
50
- ver:'OWASP_CRS/4.9.0',\
52
+ ver:'OWASP_CRS/4.16.0',\
51
53
  severity:'ERROR',\
52
54
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}'"
53
55
 
@@ -70,9 +72,10 @@ SecRule RESPONSE_BODY "@rx (?:\b(?:f(?:tp_(?:nb_)?f?(?:ge|pu)t|get(?:s?s|c)|scan
70
72
  tag:'attack-disclosure',\
71
73
  tag:'paranoia-level/1',\
72
74
  tag:'OWASP_CRS',\
75
+ tag:'OWASP_CRS/DATA-LEAKAGES-PHP',\
73
76
  tag:'capec/1000/118/116',\
74
77
  tag:'PCI/6.5.6',\
75
- ver:'OWASP_CRS/4.9.0',\
78
+ ver:'OWASP_CRS/4.16.0',\
76
79
  severity:'ERROR',\
77
80
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}'"
78
81
 
@@ -96,15 +99,16 @@ SecRule RESPONSE_BODY "@rx (?i)<\?(?:=|php)?\s+" \
96
99
  tag:'attack-disclosure',\
97
100
  tag:'paranoia-level/1',\
98
101
  tag:'OWASP_CRS',\
102
+ tag:'OWASP_CRS/DATA-LEAKAGES-PHP',\
99
103
  tag:'capec/1000/118/116',\
100
104
  tag:'PCI/6.5.6',\
101
- ver:'OWASP_CRS/4.9.0',\
105
+ ver:'OWASP_CRS/4.16.0',\
102
106
  severity:'ERROR',\
103
107
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}'"
104
108
 
105
109
 
106
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:953013,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-953-DATA-LEAKAGES-PHP"
107
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:953014,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-953-DATA-LEAKAGES-PHP"
110
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:953013,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-953-DATA-LEAKAGES-PHP"
111
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:953014,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-953-DATA-LEAKAGES-PHP"
108
112
  #
109
113
  # -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)
110
114
  #
@@ -129,23 +133,24 @@ SecRule RESPONSE_BODY "@pmFromFile php-errors-pl2.data" \
129
133
  tag:'attack-disclosure',\
130
134
  tag:'paranoia-level/2',\
131
135
  tag:'OWASP_CRS',\
136
+ tag:'OWASP_CRS/DATA-LEAKAGES-PHP',\
132
137
  tag:'capec/1000/118/116',\
133
138
  tag:'PCI/6.5.6',\
134
- ver:'OWASP_CRS/4.9.0',\
139
+ ver:'OWASP_CRS/4.16.0',\
135
140
  severity:'ERROR',\
136
141
  setvar:'tx.outbound_anomaly_score_pl2=+%{tx.error_anomaly_score}'"
137
142
 
138
143
 
139
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:953015,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-953-DATA-LEAKAGES-PHP"
140
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:953016,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-953-DATA-LEAKAGES-PHP"
144
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:953015,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-953-DATA-LEAKAGES-PHP"
145
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:953016,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-953-DATA-LEAKAGES-PHP"
141
146
  #
142
147
  # -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)
143
148
  #
144
149
 
145
150
 
146
151
 
147
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:953017,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-953-DATA-LEAKAGES-PHP"
148
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:953018,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-953-DATA-LEAKAGES-PHP"
152
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:953017,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-953-DATA-LEAKAGES-PHP"
153
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:953018,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-953-DATA-LEAKAGES-PHP"
149
154
  #
150
155
  # -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)
151
156
  #