@abtnode/router-provider 1.16.45 → 1.16.46-beta-20250703-050038-4ba2582f

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (34) hide show
  1. package/lib/nginx/includes/security/crs4/rules/REQUEST-901-INITIALIZATION.conf +42 -40
  2. package/lib/nginx/includes/security/crs4/rules/REQUEST-905-COMMON-EXCEPTIONS.conf +4 -4
  3. package/lib/nginx/includes/security/crs4/rules/REQUEST-911-METHOD-ENFORCEMENT.conf +12 -11
  4. package/lib/nginx/includes/security/crs4/rules/REQUEST-913-SCANNER-DETECTION.conf +12 -11
  5. package/lib/nginx/includes/security/crs4/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf +127 -148
  6. package/lib/nginx/includes/security/crs4/rules/REQUEST-921-PROTOCOL-ATTACK.conf +80 -35
  7. package/lib/nginx/includes/security/crs4/rules/REQUEST-922-MULTIPART-ATTACK.conf +12 -6
  8. package/lib/nginx/includes/security/crs4/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf +22 -17
  9. package/lib/nginx/includes/security/crs4/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf +20 -15
  10. package/lib/nginx/includes/security/crs4/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf +254 -86
  11. package/lib/nginx/includes/security/crs4/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf +172 -65
  12. package/lib/nginx/includes/security/crs4/rules/REQUEST-934-APPLICATION-ATTACK-GENERIC.conf +65 -29
  13. package/lib/nginx/includes/security/crs4/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf +114 -78
  14. package/lib/nginx/includes/security/crs4/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf +182 -120
  15. package/lib/nginx/includes/security/crs4/rules/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.conf +19 -16
  16. package/lib/nginx/includes/security/crs4/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf +48 -34
  17. package/lib/nginx/includes/security/crs4/rules/REQUEST-949-BLOCKING-EVALUATION.conf +30 -30
  18. package/lib/nginx/includes/security/crs4/rules/RESPONSE-950-DATA-LEAKAGES.conf +20 -15
  19. package/lib/nginx/includes/security/crs4/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf +47 -29
  20. package/lib/nginx/includes/security/crs4/rules/RESPONSE-952-DATA-LEAKAGES-JAVA.conf +15 -36
  21. package/lib/nginx/includes/security/crs4/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf +20 -15
  22. package/lib/nginx/includes/security/crs4/rules/RESPONSE-954-DATA-LEAKAGES-IIS.conf +22 -17
  23. package/lib/nginx/includes/security/crs4/rules/RESPONSE-955-WEB-SHELLS.conf +92 -43
  24. package/lib/nginx/includes/security/crs4/rules/RESPONSE-959-BLOCKING-EVALUATION.conf +30 -30
  25. package/lib/nginx/includes/security/crs4/rules/RESPONSE-980-CORRELATION.conf +23 -23
  26. package/lib/nginx/includes/security/crs4/rules/java-classes.data +11 -0
  27. package/lib/nginx/includes/security/crs4/rules/lfi-os-files.data +227 -15
  28. package/lib/nginx/includes/security/crs4/rules/php-function-names-933150.data +0 -7
  29. package/lib/nginx/includes/security/crs4/rules/restricted-files.data +250 -29
  30. package/lib/nginx/includes/security/crs4/rules/restricted-upload.data +200 -26
  31. package/lib/nginx/includes/security/crs4/rules/unix-shell-builtins.data +20 -0
  32. package/lib/nginx/includes/security/crs4/rules/unix-shell.data +39 -18
  33. package/lib/nginx/includes/security/crs4/rules/web-shells-asp.data +23 -0
  34. package/package.json +7 -7
package/lib/nginx/includes/security/crs4/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf CHANGED
@@ -1,7 +1,7 @@
1
1
  # ------------------------------------------------------------------------
2
- # OWASP CRS ver.4.9.0
2
+ # OWASP CRS ver.4.16.0
3
3
  # Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
4
- # Copyright (c) 2021-2024 CRS project. All rights reserved.
4
+ # Copyright (c) 2021-2025 CRS project. All rights reserved.
5
5
  #
6
6
  # The OWASP CRS is distributed under
7
7
  # Apache Software License (ASL) version 2
@@ -23,8 +23,8 @@
23
23
  #
24
24
 
25
25
 
26
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:920011,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT"
27
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:920012,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT"
26
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:920011,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT"
27
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:920012,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT"
28
28
  #
29
29
  # -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)
30
30
  #
@@ -63,8 +63,9 @@ SecRule REQUEST_LINE "!@rx (?i)^(?:get /[^#\?]*(?:\?[^\s\x0b#]*)?(?:#[^\s\x0b]*)
63
63
  tag:'attack-protocol',\
64
64
  tag:'paranoia-level/1',\
65
65
  tag:'OWASP_CRS',\
66
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
66
67
  tag:'capec/1000/210/272',\
67
- ver:'OWASP_CRS/4.9.0',\
68
+ ver:'OWASP_CRS/4.16.0',\
68
69
  severity:'WARNING',\
69
70
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.warning_anomaly_score}'"
70
71
 
@@ -118,8 +119,9 @@ SecRule FILES|FILES_NAMES "!@rx (?i)^(?:&(?:(?:[acegilnorsuz]acut|[aeiou]grav|[a
118
119
  tag:'attack-protocol',\
119
120
  tag:'paranoia-level/1',\
120
121
  tag:'OWASP_CRS',\
122
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
121
123
  tag:'capec/1000/210/272',\
122
- ver:'OWASP_CRS/4.9.0',\
124
+ ver:'OWASP_CRS/4.16.0',\
123
125
  severity:'CRITICAL',\
124
126
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
125
127
 
@@ -147,8 +149,9 @@ SecRule REQUEST_HEADERS:Content-Length "!@rx ^\d+$" \
147
149
  tag:'attack-protocol',\
148
150
  tag:'paranoia-level/1',\
149
151
  tag:'OWASP_CRS',\
152
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
150
153
  tag:'capec/1000/210/272',\
151
- ver:'OWASP_CRS/4.9.0',\
154
+ ver:'OWASP_CRS/4.16.0',\
152
155
  severity:'CRITICAL',\
153
156
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
154
157
 
@@ -181,8 +184,9 @@ SecRule REQUEST_METHOD "@rx ^(?:GET|HEAD)$" \
181
184
  tag:'attack-protocol',\
182
185
  tag:'paranoia-level/1',\
183
186
  tag:'OWASP_CRS',\
187
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
184
188
  tag:'capec/1000/210/272',\
185
- ver:'OWASP_CRS/4.9.0',\
189
+ ver:'OWASP_CRS/4.16.0',\
186
190
  severity:'CRITICAL',\
187
191
  chain"
188
192
  SecRule REQUEST_HEADERS:Content-Length "!@rx ^0?$" \
@@ -206,8 +210,9 @@ SecRule REQUEST_METHOD "@rx ^(?:GET|HEAD)$" \
206
210
  tag:'attack-protocol',\
207
211
  tag:'paranoia-level/1',\
208
212
  tag:'OWASP_CRS',\
213
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
209
214
  tag:'capec/1000/210/272',\
210
- ver:'OWASP_CRS/4.9.0',\
215
+ ver:'OWASP_CRS/4.16.0',\
211
216
  severity:'CRITICAL',\
212
217
  chain"
213
218
  SecRule &REQUEST_HEADERS:Transfer-Encoding "!@eq 0" \
@@ -246,8 +251,9 @@ SecRule REQUEST_PROTOCOL "!@within HTTP/2 HTTP/2.0 HTTP/3 HTTP/3.0" \
246
251
  tag:'attack-protocol',\
247
252
  tag:'paranoia-level/1',\
248
253
  tag:'OWASP_CRS',\
254
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
249
255
  tag:'capec/1000/210/272',\
250
- ver:'OWASP_CRS/4.9.0',\
256
+ ver:'OWASP_CRS/4.16.0',\
251
257
  severity:'WARNING',\
252
258
  chain"
253
259
  SecRule REQUEST_METHOD "@streq POST" \
@@ -276,8 +282,9 @@ SecRule &REQUEST_HEADERS:Transfer-Encoding "!@eq 0" \
276
282
  tag:'attack-protocol',\
277
283
  tag:'paranoia-level/1',\
278
284
  tag:'OWASP_CRS',\
285
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
279
286
  tag:'capec/1000/210/272',\
280
- ver:'OWASP_CRS/4.9.0',\
287
+ ver:'OWASP_CRS/4.16.0',\
281
288
  severity:'WARNING',\
282
289
  chain"
283
290
  SecRule &REQUEST_HEADERS:Content-Length "!@eq 0" \
@@ -314,8 +321,9 @@ SecRule REQUEST_HEADERS:Range|REQUEST_HEADERS:Request-Range "@rx (\d+)-(\d+)" \
314
321
  tag:'attack-protocol',\
315
322
  tag:'paranoia-level/1',\
316
323
  tag:'OWASP_CRS',\
324
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
317
325
  tag:'capec/1000/210/272',\
318
- ver:'OWASP_CRS/4.9.0',\
326
+ ver:'OWASP_CRS/4.16.0',\
319
327
  severity:'WARNING',\
320
328
  chain"
321
329
  SecRule TX:2 "@lt %{tx.1}" \
@@ -346,89 +354,12 @@ SecRule REQUEST_HEADERS:Connection "@rx \b(?:keep-alive|close),\s?(?:keep-alive|
346
354
  tag:'attack-protocol',\
347
355
  tag:'paranoia-level/1',\
348
356
  tag:'OWASP_CRS',\
357
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
349
358
  tag:'capec/1000/210/272',\
350
- ver:'OWASP_CRS/4.9.0',\
359
+ ver:'OWASP_CRS/4.16.0',\
351
360
  severity:'WARNING',\
352
361
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.warning_anomaly_score}'"
353
362
 
354
- #
355
- # Check URL encodings
356
- #
357
- # -=[ Rule Logic ]=-
358
- # There are two different chained rules. We need to separate them as we are inspecting two
359
- # different variables - REQUEST_URI_RAW and REQUEST_BODY. For REQUEST_BODY, we only want to
360
- # run the @validateUrlEncoding operator if the content-type is application/x-www-form-urlencoding.
361
- #
362
- # We exclude the last path segment from validation because it could be a file name, which could
363
- # easily contain a '%' character that is not part of a URI encoded sequence.
364
- #
365
- # -=[ References ]=-
366
- # http://www.ietf.org/rfc/rfc1738.txt
367
- #
368
- # -=[ Example payload ]=-
369
- # http://localhost/?s=a%20b%20c%'/
370
- # reason: %'/ is not a valid url encoding
371
- #
372
- # Regular expression generated from regex-assembly/920220-chain1.ra.
373
- # To update the regular expression run the following shell script
374
- # (consult https://coreruleset.org/docs/development/regex_assembly/ for details):
375
- # crs-toolchain regex update 920220-chain1
376
- #
377
- SecRule REQUEST_URI_RAW "@rx \x25" \
378
- "id:920220,\
379
- phase:1,\
380
- block,\
381
- t:none,t:urlDecodeUni,\
382
- msg:'URL Encoding Abuse Attack Attempt',\
383
- logdata:'%{REQUEST_URI_RAW}',\
384
- tag:'application-multi',\
385
- tag:'language-multi',\
386
- tag:'platform-multi',\
387
- tag:'attack-protocol',\
388
- tag:'paranoia-level/1',\
389
- tag:'OWASP_CRS',\
390
- tag:'capec/1000/255/153/267/72',\
391
- ver:'OWASP_CRS/4.9.0',\
392
- severity:'CRITICAL',\
393
- chain"
394
- SecRule REQUEST_URI_RAW "@rx ^(.*)/(?:[^\?]+)?(\?.*)?$" \
395
- "capture,\
396
- chain"
397
- SecRule TX:1|TX:2 "@validateUrlEncoding" \
398
- "t:none,t:urlDecodeUni,\
399
- setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
400
-
401
-
402
- # Validate URI encoding of the last path segment, only if it does not look like a file name.
403
- # A file name could easily contain a '%' character that is not part of a URI encoded sequence.
404
- #
405
- # Regular expression generated from regex-assembly/920221.ra.
406
- # To update the regular expression run the following shell script
407
- # (consult https://coreruleset.org/docs/development/regex_assembly/ for details):
408
- # crs-toolchain regex update 920221
409
- #
410
- SecRule REQUEST_BASENAME "!@rx ^.*%.*\.[^\s\x0b\.]+$" \
411
- "id:920221,\
412
- phase:1,\
413
- block,\
414
- capture,\
415
- t:none,t:urlDecodeUni,\
416
- msg:'URL Encoding Abuse Attack Attempt',\
417
- logdata:'%{REQUEST_BASENAME}',\
418
- tag:'application-multi',\
419
- tag:'language-multi',\
420
- tag:'platform-multi',\
421
- tag:'attack-protocol',\
422
- tag:'paranoia-level/1',\
423
- tag:'OWASP_CRS',\
424
- tag:'capec/1000/255/153/267/72',\
425
- ver:'OWASP_CRS/4.9.0',\
426
- severity:'CRITICAL',\
427
- chain"
428
- SecRule TX:0 "@validateUrlEncoding" \
429
- "t:none,t:urlDecodeUni,\
430
- setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
431
-
432
363
 
433
364
  #
434
365
  # Check UTF encoding
@@ -452,8 +383,9 @@ SecRule TX:CRS_VALIDATE_UTF8_ENCODING "@eq 1" \
452
383
  tag:'attack-protocol',\
453
384
  tag:'paranoia-level/1',\
454
385
  tag:'OWASP_CRS',\
386
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
455
387
  tag:'capec/1000/255/153/267',\
456
- ver:'OWASP_CRS/4.9.0',\
388
+ ver:'OWASP_CRS/4.16.0',\
457
389
  severity:'WARNING',\
458
390
  chain"
459
391
  SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES "@validateUtf8Encoding" \
@@ -496,8 +428,9 @@ SecRule REQUEST_URI|REQUEST_BODY "@rx (?i)%uff[0-9a-f]{2}" \
496
428
  tag:'attack-protocol',\
497
429
  tag:'paranoia-level/1',\
498
430
  tag:'OWASP_CRS',\
431
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
499
432
  tag:'capec/1000/255/153/267/72',\
500
- ver:'OWASP_CRS/4.9.0',\
433
+ ver:'OWASP_CRS/4.16.0',\
501
434
  severity:'WARNING',\
502
435
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.warning_anomaly_score}'"
503
436
 
@@ -539,7 +472,7 @@ SecRule REQUEST_URI|REQUEST_BODY "@rx (?i)%uff[0-9a-f]{2}" \
539
472
  # 920274 generally has few positives. However, it would detect rare attacks
540
473
  # on Accept request headers and friends.
541
474
 
542
- SecRule REQUEST_URI|REQUEST_HEADERS|ARGS|ARGS_NAMES "@validateByteRange 1-255" \
475
+ SecRule REQUEST_URI_RAW|REQUEST_HEADERS|ARGS|ARGS_NAMES "@validateByteRange 1-255" \
543
476
  "id:920270,\
544
477
  phase:2,\
545
478
  block,\
@@ -552,8 +485,9 @@ SecRule REQUEST_URI|REQUEST_HEADERS|ARGS|ARGS_NAMES "@validateByteRange 1-255" \
552
485
  tag:'attack-protocol',\
553
486
  tag:'paranoia-level/1',\
554
487
  tag:'OWASP_CRS',\
488
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
555
489
  tag:'capec/1000/210/272',\
556
- ver:'OWASP_CRS/4.9.0',\
490
+ ver:'OWASP_CRS/4.16.0',\
557
491
  severity:'CRITICAL',\
558
492
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
559
493
 
@@ -583,9 +517,10 @@ SecRule &REQUEST_HEADERS:Host "@eq 0" \
583
517
  tag:'attack-protocol',\
584
518
  tag:'paranoia-level/1',\
585
519
  tag:'OWASP_CRS',\
520
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
586
521
  tag:'capec/1000/210/272',\
587
522
  tag:'PCI/6.5.10',\
588
- ver:'OWASP_CRS/4.9.0',\
523
+ ver:'OWASP_CRS/4.16.0',\
589
524
  severity:'WARNING',\
590
525
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.warning_anomaly_score}',\
591
526
  skipAfter:END-HOST-CHECK"
@@ -603,8 +538,9 @@ SecRule REQUEST_HEADERS:Host "@rx ^$" \
603
538
  tag:'attack-protocol',\
604
539
  tag:'paranoia-level/1',\
605
540
  tag:'OWASP_CRS',\
541
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
606
542
  tag:'capec/1000/210/272',\
607
- ver:'OWASP_CRS/4.9.0',\
543
+ ver:'OWASP_CRS/4.16.0',\
608
544
  severity:'CRITICAL',\
609
545
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
610
546
 
@@ -643,8 +579,9 @@ SecRule REQUEST_HEADERS:Accept "@rx ^$" \
643
579
  tag:'attack-protocol',\
644
580
  tag:'paranoia-level/1',\
645
581
  tag:'OWASP_CRS',\
582
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
646
583
  tag:'capec/1000/210/272',\
647
- ver:'OWASP_CRS/4.9.0',\
584
+ ver:'OWASP_CRS/4.16.0',\
648
585
  severity:'NOTICE',\
649
586
  chain"
650
587
  SecRule REQUEST_METHOD "!@rx ^OPTIONS$" \
@@ -668,8 +605,9 @@ SecRule REQUEST_HEADERS:Accept "@rx ^$" \
668
605
  tag:'attack-protocol',\
669
606
  tag:'paranoia-level/1',\
670
607
  tag:'OWASP_CRS',\
608
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
671
609
  tag:'capec/1000/210/272',\
672
- ver:'OWASP_CRS/4.9.0',\
610
+ ver:'OWASP_CRS/4.16.0',\
673
611
  severity:'NOTICE',\
674
612
  chain"
675
613
  SecRule REQUEST_METHOD "!@rx ^OPTIONS$" \
@@ -701,8 +639,9 @@ SecRule REQUEST_HEADERS:User-Agent "@rx ^$" \
701
639
  tag:'attack-protocol',\
702
640
  tag:'paranoia-level/1',\
703
641
  tag:'OWASP_CRS',\
642
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
704
643
  tag:'capec/1000/210/272',\
705
- ver:'OWASP_CRS/4.9.0',\
644
+ ver:'OWASP_CRS/4.16.0',\
706
645
  severity:'NOTICE',\
707
646
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.notice_anomaly_score}'"
708
647
 
@@ -738,8 +677,9 @@ SecRule REQUEST_HEADERS:Content-Length "!@rx ^0$" \
738
677
  tag:'attack-protocol',\
739
678
  tag:'paranoia-level/1',\
740
679
  tag:'OWASP_CRS',\
680
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
741
681
  tag:'capec/1000/210/272',\
742
- ver:'OWASP_CRS/4.9.0',\
682
+ ver:'OWASP_CRS/4.16.0',\
743
683
  severity:'NOTICE',\
744
684
  chain"
745
685
  SecRule &REQUEST_HEADERS:Content-Type "@eq 0" \
@@ -782,9 +722,10 @@ SecRule REQUEST_HEADERS:Host "@rx (?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$
782
722
  tag:'attack-protocol',\
783
723
  tag:'paranoia-level/1',\
784
724
  tag:'OWASP_CRS',\
725
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
785
726
  tag:'capec/1000/210/272',\
786
727
  tag:'PCI/6.5.10',\
787
- ver:'OWASP_CRS/4.9.0',\
728
+ ver:'OWASP_CRS/4.16.0',\
788
729
  severity:'WARNING',\
789
730
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.warning_anomaly_score}'"
790
731
 
@@ -815,8 +756,9 @@ SecRule &TX:MAX_NUM_ARGS "@eq 1" \
815
756
  tag:'attack-protocol',\
816
757
  tag:'paranoia-level/1',\
817
758
  tag:'OWASP_CRS',\
759
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
818
760
  tag:'capec/1000/210/272',\
819
- ver:'OWASP_CRS/4.9.0',\
761
+ ver:'OWASP_CRS/4.16.0',\
820
762
  severity:'CRITICAL',\
821
763
  chain"
822
764
  SecRule &ARGS "@gt %{tx.max_num_args}" \
@@ -840,8 +782,9 @@ SecRule &TX:ARG_NAME_LENGTH "@eq 1" \
840
782
  tag:'attack-protocol',\
841
783
  tag:'paranoia-level/1',\
842
784
  tag:'OWASP_CRS',\
785
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
843
786
  tag:'capec/1000/210/272',\
844
- ver:'OWASP_CRS/4.9.0',\
787
+ ver:'OWASP_CRS/4.16.0',\
845
788
  severity:'CRITICAL',\
846
789
  chain"
847
790
  SecRule ARGS_NAMES "@gt %{tx.arg_name_length}" \
@@ -867,8 +810,9 @@ SecRule &TX:ARG_LENGTH "@eq 1" \
867
810
  tag:'attack-protocol',\
868
811
  tag:'paranoia-level/1',\
869
812
  tag:'OWASP_CRS',\
813
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
870
814
  tag:'capec/1000/210/272',\
871
- ver:'OWASP_CRS/4.9.0',\
815
+ ver:'OWASP_CRS/4.16.0',\
872
816
  severity:'CRITICAL',\
873
817
  chain"
874
818
  SecRule ARGS "@gt %{tx.arg_length}" \
@@ -891,8 +835,9 @@ SecRule &TX:TOTAL_ARG_LENGTH "@eq 1" \
891
835
  tag:'attack-protocol',\
892
836
  tag:'paranoia-level/1',\
893
837
  tag:'OWASP_CRS',\
838
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
894
839
  tag:'capec/1000/210/272',\
895
- ver:'OWASP_CRS/4.9.0',\
840
+ ver:'OWASP_CRS/4.16.0',\
896
841
  severity:'CRITICAL',\
897
842
  chain"
898
843
  SecRule ARGS_COMBINED_SIZE "@gt %{tx.total_arg_length}" \
@@ -916,8 +861,9 @@ SecRule &TX:MAX_FILE_SIZE "@eq 1" \
916
861
  tag:'attack-protocol',\
917
862
  tag:'paranoia-level/1',\
918
863
  tag:'OWASP_CRS',\
864
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
919
865
  tag:'capec/1000/210/272',\
920
- ver:'OWASP_CRS/4.9.0',\
866
+ ver:'OWASP_CRS/4.16.0',\
921
867
  severity:'CRITICAL',\
922
868
  chain"
923
869
  SecRule REQUEST_HEADERS:Content-Type "@rx ^(?i)multipart/form-data" \
@@ -942,8 +888,9 @@ SecRule &TX:COMBINED_FILE_SIZES "@eq 1" \
942
888
  tag:'attack-protocol',\
943
889
  tag:'paranoia-level/1',\
944
890
  tag:'OWASP_CRS',\
891
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
945
892
  tag:'capec/1000/210/272',\
946
- ver:'OWASP_CRS/4.9.0',\
893
+ ver:'OWASP_CRS/4.16.0',\
947
894
  severity:'CRITICAL',\
948
895
  chain"
949
896
  SecRule FILES_COMBINED_SIZE "@gt %{tx.combined_file_sizes}" \
@@ -981,9 +928,10 @@ SecRule REQUEST_HEADERS:Content-Type "!@rx ^[\w/.+*-]+(?:\s?;\s*(?:action|bounda
981
928
  tag:'attack-protocol',\
982
929
  tag:'paranoia-level/1',\
983
930
  tag:'OWASP_CRS',\
931
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
984
932
  tag:'capec/1000/255/153',\
985
933
  tag:'PCI/12.1',\
986
- ver:'OWASP_CRS/4.9.0',\
934
+ ver:'OWASP_CRS/4.16.0',\
987
935
  severity:'CRITICAL',\
988
936
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
989
937
 
@@ -1004,9 +952,10 @@ SecRule REQUEST_HEADERS:Content-Type "@rx ^[^;\s]+" \
1004
952
  tag:'attack-protocol',\
1005
953
  tag:'paranoia-level/1',\
1006
954
  tag:'OWASP_CRS',\
955
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
1007
956
  tag:'capec/1000/255/153',\
1008
957
  tag:'PCI/12.1',\
1009
- ver:'OWASP_CRS/4.9.0',\
958
+ ver:'OWASP_CRS/4.16.0',\
1010
959
  severity:'CRITICAL',\
1011
960
  setvar:'tx.content_type=|%{tx.0}|',\
1012
961
  chain"
@@ -1032,9 +981,10 @@ SecRule REQUEST_HEADERS:Content-Type "@rx charset\s*=\s*[\"']?([^;\"'\s]+)" \
1032
981
  tag:'attack-protocol',\
1033
982
  tag:'paranoia-level/1',\
1034
983
  tag:'OWASP_CRS',\
984
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
1035
985
  tag:'capec/1000/255/153',\
1036
986
  tag:'PCI/12.1',\
1037
- ver:'OWASP_CRS/4.9.0',\
987
+ ver:'OWASP_CRS/4.16.0',\
1038
988
  severity:'CRITICAL',\
1039
989
  setvar:'tx.content_type_charset=|%{tx.1}|',\
1040
990
  chain"
@@ -1059,9 +1009,10 @@ SecRule REQUEST_HEADERS:Content-Type "@rx charset.*?charset" \
1059
1009
  tag:'attack-protocol',\
1060
1010
  tag:'paranoia-level/1',\
1061
1011
  tag:'OWASP_CRS',\
1012
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
1062
1013
  tag:'capec/1000/255/153',\
1063
1014
  tag:'PCI/12.1',\
1064
- ver:'OWASP_CRS/4.9.0',\
1015
+ ver:'OWASP_CRS/4.16.0',\
1065
1016
  severity:'CRITICAL',\
1066
1017
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
1067
1018
 
@@ -1081,9 +1032,10 @@ SecRule REQUEST_PROTOCOL "!@within %{tx.allowed_http_versions}" \
1081
1032
  tag:'attack-protocol',\
1082
1033
  tag:'paranoia-level/1',\
1083
1034
  tag:'OWASP_CRS',\
1035
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
1084
1036
  tag:'capec/1000/210/272',\
1085
1037
  tag:'PCI/6.5.10',\
1086
- ver:'OWASP_CRS/4.9.0',\
1038
+ ver:'OWASP_CRS/4.16.0',\
1087
1039
  severity:'CRITICAL',\
1088
1040
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
1089
1041
 
@@ -1104,9 +1056,10 @@ SecRule REQUEST_BASENAME "@rx \.([^.]+)$" \
1104
1056
  tag:'attack-protocol',\
1105
1057
  tag:'paranoia-level/1',\
1106
1058
  tag:'OWASP_CRS',\
1059
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
1107
1060
  tag:'capec/1000/210/272',\
1108
1061
  tag:'PCI/6.5.10',\
1109
- ver:'OWASP_CRS/4.9.0',\
1062
+ ver:'OWASP_CRS/4.16.0',\
1110
1063
  severity:'CRITICAL',\
1111
1064
  setvar:'tx.extension=.%{tx.1}/',\
1112
1065
  chain"
@@ -1131,9 +1084,10 @@ SecRule REQUEST_FILENAME "@rx \.[^.~]+~(?:/.*|)$" \
1131
1084
  tag:'attack-protocol',\
1132
1085
  tag:'paranoia-level/1',\
1133
1086
  tag:'OWASP_CRS',\
1087
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
1134
1088
  tag:'capec/1000/210/272',\
1135
1089
  tag:'PCI/6.5.10',\
1136
- ver:'OWASP_CRS/4.9.0',\
1090
+ ver:'OWASP_CRS/4.16.0',\
1137
1091
  severity:'CRITICAL',\
1138
1092
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
1139
1093
 
@@ -1185,9 +1139,10 @@ SecRule REQUEST_HEADERS_NAMES "@rx ^.*$" \
1185
1139
  tag:'attack-protocol',\
1186
1140
  tag:'paranoia-level/1',\
1187
1141
  tag:'OWASP_CRS',\
1142
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
1188
1143
  tag:'capec/1000/210/272',\
1189
1144
  tag:'PCI/12.1',\
1190
- ver:'OWASP_CRS/4.9.0',\
1145
+ ver:'OWASP_CRS/4.16.0',\
1191
1146
  severity:'CRITICAL',\
1192
1147
  setvar:'tx.header_name_920450_%{tx.0}=/%{tx.0}/',\
1193
1148
  chain"
@@ -1219,9 +1174,10 @@ SecRule REQUEST_HEADERS:Accept-Encoding "@gt 100" \
1219
1174
  tag:'attack-protocol',\
1220
1175
  tag:'paranoia-level/1',\
1221
1176
  tag:'OWASP_CRS',\
1177
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
1222
1178
  tag:'capec/1000/255/153',\
1223
1179
  tag:'PCI/12.1',\
1224
- ver:'OWASP_CRS/4.9.0',\
1180
+ ver:'OWASP_CRS/4.16.0',\
1225
1181
  severity:'CRITICAL',\
1226
1182
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
1227
1183
 
@@ -1253,7 +1209,8 @@ SecRule REQUEST_HEADERS:Accept "!@rx ^(?:(?:\*|[^!\"\(\),/:-\?\[-\]\{\}]+)/(?:\*
1253
1209
  tag:'attack-protocol',\
1254
1210
  tag:'paranoia-level/1',\
1255
1211
  tag:'OWASP_CRS',\
1256
- ver:'OWASP_CRS/4.9.0',\
1212
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
1213
+ ver:'OWASP_CRS/4.16.0',\
1257
1214
  severity:'CRITICAL',\
1258
1215
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
1259
1216
 
@@ -1275,8 +1232,9 @@ SecRule REQBODY_PROCESSOR "!@streq JSON" \
1275
1232
  tag:'attack-protocol',\
1276
1233
  tag:'paranoia-level/1',\
1277
1234
  tag:'OWASP_CRS',\
1235
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
1278
1236
  tag:'capec/1000/255/153/267/72',\
1279
- ver:'OWASP_CRS/4.9.0',\
1237
+ ver:'OWASP_CRS/4.16.0',\
1280
1238
  severity:'CRITICAL',\
1281
1239
  chain"
1282
1240
  SecRule REQUEST_URI|REQUEST_HEADERS|ARGS|ARGS_NAMES "@rx (?i)\x5cu[0-9a-f]{4}" \
@@ -1300,7 +1258,8 @@ SecRule REQUEST_URI_RAW "@contains #" \
1300
1258
  tag:'attack-protocol',\
1301
1259
  tag:'paranoia-level/1',\
1302
1260
  tag:'OWASP_CRS',\
1303
- ver:'OWASP_CRS/4.9.0',\
1261
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
1262
+ ver:'OWASP_CRS/4.16.0',\
1304
1263
  severity:'CRITICAL',\
1305
1264
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
1306
1265
 
@@ -1332,13 +1291,14 @@ SecRule &REQUEST_HEADERS:Content-Type "@gt 1" \
1332
1291
  tag:'attack-protocol',\
1333
1292
  tag:'paranoia-level/1',\
1334
1293
  tag:'OWASP_CRS',\
1335
- ver:'OWASP_CRS/4.9.0',\
1294
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
1295
+ ver:'OWASP_CRS/4.16.0',\
1336
1296
  severity:'CRITICAL',\
1337
1297
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
1338
1298
 
1339
1299
 
1340
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:920013,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT"
1341
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:920014,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT"
1300
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:920013,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT"
1301
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:920014,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT"
1342
1302
  #
1343
1303
  # -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)
1344
1304
  #
@@ -1376,8 +1336,9 @@ SecRule REQUEST_HEADERS:Range|REQUEST_HEADERS:Request-Range "@rx ^bytes=(?:(?:\d
1376
1336
  tag:'attack-protocol',\
1377
1337
  tag:'paranoia-level/2',\
1378
1338
  tag:'OWASP_CRS',\
1339
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
1379
1340
  tag:'capec/1000/210/272',\
1380
- ver:'OWASP_CRS/4.9.0',\
1341
+ ver:'OWASP_CRS/4.16.0',\
1381
1342
  severity:'WARNING',\
1382
1343
  chain"
1383
1344
  SecRule REQUEST_BASENAME "!@endsWith .pdf" \
@@ -1400,8 +1361,9 @@ SecRule REQUEST_BASENAME "@endsWith .pdf" \
1400
1361
  tag:'attack-protocol',\
1401
1362
  tag:'paranoia-level/2',\
1402
1363
  tag:'OWASP_CRS',\
1364
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
1403
1365
  tag:'capec/1000/210/272',\
1404
- ver:'OWASP_CRS/4.9.0',\
1366
+ ver:'OWASP_CRS/4.16.0',\
1405
1367
  severity:'WARNING',\
1406
1368
  chain"
1407
1369
  SecRule REQUEST_HEADERS:Range|REQUEST_HEADERS:Request-Range "@rx ^bytes=(?:(?:\d+)?-(?:\d+)?\s*,?\s*){63}" \
@@ -1421,8 +1383,9 @@ SecRule ARGS "@rx %[0-9a-fA-F]{2}" \
1421
1383
  tag:'attack-protocol',\
1422
1384
  tag:'paranoia-level/2',\
1423
1385
  tag:'OWASP_CRS',\
1386
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
1424
1387
  tag:'capec/1000/255/153/267/120',\
1425
- ver:'OWASP_CRS/4.9.0',\
1388
+ ver:'OWASP_CRS/4.16.0',\
1426
1389
  severity:'WARNING',\
1427
1390
  setvar:'tx.inbound_anomaly_score_pl2=+%{tx.warning_anomaly_score}'"
1428
1391
 
@@ -1430,7 +1393,7 @@ SecRule ARGS "@rx %[0-9a-fA-F]{2}" \
1430
1393
  #
1431
1394
  # PL2: This is a stricter sibling of 920270.
1432
1395
  #
1433
- SecRule REQUEST_URI|REQUEST_HEADERS|ARGS|ARGS_NAMES "@validateByteRange 9,10,13,32-126,128-255" \
1396
+ SecRule REQUEST_URI_RAW|REQUEST_HEADERS|ARGS|ARGS_NAMES "@validateByteRange 9,10,13,32-126,128-255" \
1434
1397
  "id:920271,\
1435
1398
  phase:2,\
1436
1399
  block,\
@@ -1443,8 +1406,9 @@ SecRule REQUEST_URI|REQUEST_HEADERS|ARGS|ARGS_NAMES "@validateByteRange 9,10,13,
1443
1406
  tag:'attack-protocol',\
1444
1407
  tag:'paranoia-level/2',\
1445
1408
  tag:'OWASP_CRS',\
1409
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
1446
1410
  tag:'capec/1000/210/272',\
1447
- ver:'OWASP_CRS/4.9.0',\
1411
+ ver:'OWASP_CRS/4.16.0',\
1448
1412
  severity:'CRITICAL',\
1449
1413
  setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
1450
1414
 
@@ -1469,9 +1433,10 @@ SecRule &REQUEST_HEADERS:User-Agent "@eq 0" \
1469
1433
  tag:'attack-protocol',\
1470
1434
  tag:'paranoia-level/2',\
1471
1435
  tag:'OWASP_CRS',\
1436
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
1472
1437
  tag:'capec/1000/210/272',\
1473
1438
  tag:'PCI/6.5.10',\
1474
- ver:'OWASP_CRS/4.9.0',\
1439
+ ver:'OWASP_CRS/4.16.0',\
1475
1440
  severity:'NOTICE',\
1476
1441
  setvar:'tx.inbound_anomaly_score_pl2=+%{tx.notice_anomaly_score}'"
1477
1442
 
@@ -1492,8 +1457,9 @@ SecRule FILES_NAMES|FILES "@rx ['\";=\x5c]" \
1492
1457
  tag:'attack-protocol',\
1493
1458
  tag:'paranoia-level/2',\
1494
1459
  tag:'OWASP_CRS',\
1460
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
1495
1461
  tag:'capec/1000/210/272',\
1496
- ver:'OWASP_CRS/4.9.0',\
1462
+ ver:'OWASP_CRS/4.16.0',\
1497
1463
  severity:'CRITICAL',\
1498
1464
  setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
1499
1465
 
@@ -1517,8 +1483,9 @@ SecRule REQUEST_HEADERS:Content-Length "!@rx ^0$" \
1517
1483
  tag:'attack-protocol',\
1518
1484
  tag:'paranoia-level/2',\
1519
1485
  tag:'OWASP_CRS',\
1486
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
1520
1487
  tag:'capec/1000/210/272',\
1521
- ver:'OWASP_CRS/4.9.0',\
1488
+ ver:'OWASP_CRS/4.16.0',\
1522
1489
  severity:'CRITICAL',\
1523
1490
  chain"
1524
1491
  SecRule &REQUEST_HEADERS:Content-Type "@eq 0" \
@@ -1543,9 +1510,10 @@ SecRule REQUEST_HEADERS_NAMES "@rx ^.*$" \
1543
1510
  tag:'attack-protocol',\
1544
1511
  tag:'paranoia-level/2',\
1545
1512
  tag:'OWASP_CRS',\
1513
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
1546
1514
  tag:'capec/1000/210/272',\
1547
1515
  tag:'PCI/12.1',\
1548
- ver:'OWASP_CRS/4.9.0',\
1516
+ ver:'OWASP_CRS/4.16.0',\
1549
1517
  severity:'CRITICAL',\
1550
1518
  setvar:'tx.header_name_920451_%{tx.0}=/%{tx.0}/',\
1551
1519
  chain"
@@ -1571,8 +1539,9 @@ SecRule REQUEST_HEADERS:Content-Type "@rx ^(?i)application/x-www-form-urlencoded
1571
1539
  tag:'attack-protocol',\
1572
1540
  tag:'paranoia-level/2',\
1573
1541
  tag:'OWASP_CRS',\
1542
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
1574
1543
  tag:'capec/1000/255/153/267/72',\
1575
- ver:'OWASP_CRS/4.9.0',\
1544
+ ver:'OWASP_CRS/4.16.0',\
1576
1545
  severity:'WARNING',\
1577
1546
  chain"
1578
1547
  SecRule REQUEST_BODY "@rx \x25" \
@@ -1580,8 +1549,8 @@ SecRule REQUEST_HEADERS:Content-Type "@rx ^(?i)application/x-www-form-urlencoded
1580
1549
  SecRule REQUEST_BODY "@validateUrlEncoding" \
1581
1550
  "setvar:'tx.inbound_anomaly_score_pl2=+%{tx.warning_anomaly_score}'"
1582
1551
 
1583
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:920015,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT"
1584
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:920016,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT"
1552
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:920015,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT"
1553
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:920016,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT"
1585
1554
  #
1586
1555
  # -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)
1587
1556
  #
@@ -1592,7 +1561,7 @@ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:920016,phase:2,pass,nolog,tag:'O
1592
1561
  # This rule is also triggered by the following exploit(s):
1593
1562
  # [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]
1594
1563
  #
1595
- SecRule REQUEST_URI|REQUEST_HEADERS|ARGS|ARGS_NAMES|REQUEST_BODY "@validateByteRange 32-36,38-126" \
1564
+ SecRule REQUEST_URI_RAW|REQUEST_HEADERS|ARGS|ARGS_NAMES|REQUEST_BODY "@validateByteRange 32-36,38-126" \
1596
1565
  "id:920272,\
1597
1566
  phase:2,\
1598
1567
  block,\
@@ -1605,8 +1574,9 @@ SecRule REQUEST_URI|REQUEST_HEADERS|ARGS|ARGS_NAMES|REQUEST_BODY "@validateByteR
1605
1574
  tag:'attack-protocol',\
1606
1575
  tag:'paranoia-level/3',\
1607
1576
  tag:'OWASP_CRS',\
1577
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
1608
1578
  tag:'capec/1000/210/272',\
1609
- ver:'OWASP_CRS/4.9.0',\
1579
+ ver:'OWASP_CRS/4.16.0',\
1610
1580
  severity:'CRITICAL',\
1611
1581
  setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'"
1612
1582
 
@@ -1638,9 +1608,10 @@ SecRule &REQUEST_HEADERS:Accept "@eq 0" \
1638
1608
  tag:'attack-protocol',\
1639
1609
  tag:'paranoia-level/3',\
1640
1610
  tag:'OWASP_CRS',\
1611
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
1641
1612
  tag:'capec/1000/210/272',\
1642
1613
  tag:'PCI/6.5.10',\
1643
- ver:'OWASP_CRS/4.9.0',\
1614
+ ver:'OWASP_CRS/4.16.0',\
1644
1615
  severity:'NOTICE',\
1645
1616
  chain"
1646
1617
  SecRule REQUEST_METHOD "!@rx ^(?:OPTIONS|CONNECT)$" \
@@ -1672,8 +1643,9 @@ SecRule &REQUEST_HEADERS:x-up-devcap-post-charset "@ge 1" \
1672
1643
  tag:'attack-protocol',\
1673
1644
  tag:'paranoia-level/3',\
1674
1645
  tag:'OWASP_CRS',\
1646
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
1675
1647
  tag:'capec/1000/210/272',\
1676
- ver:'OWASP_CRS/4.9.0',\
1648
+ ver:'OWASP_CRS/4.16.0',\
1677
1649
  severity:'CRITICAL',\
1678
1650
  chain"
1679
1651
  SecRule REQUEST_HEADERS:User-Agent "@rx ^(?i)up" \
@@ -1725,8 +1697,9 @@ SecRule &REQUEST_HEADERS:Cache-Control "@gt 0" \
1725
1697
  tag:'header-allowlist',\
1726
1698
  tag:'paranoia-level/3',\
1727
1699
  tag:'OWASP_CRS',\
1700
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
1728
1701
  tag:'capec/1000/210/272',\
1729
- ver:'OWASP_CRS/4.9.0',\
1702
+ ver:'OWASP_CRS/4.16.0',\
1730
1703
  severity:'CRITICAL',\
1731
1704
  chain"
1732
1705
  SecRule REQUEST_HEADERS:Cache-Control "!@rx ^(?:(?:max-age=[0-9]+|min-fresh=[0-9]+|no-cache|no-store|no-transform|only-if-cached|max-stale(?:=[0-9]+)?)(?:\s*\,\s*|$)){1,7}$" \
@@ -1755,14 +1728,15 @@ SecRule REQUEST_HEADERS:Accept-Encoding "!@rx br|compress|deflate|(?:pack200-)?g
1755
1728
  tag:'attack-protocol',\
1756
1729
  tag:'paranoia-level/3',\
1757
1730
  tag:'OWASP_CRS',\
1731
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
1758
1732
  tag:'capec/1000/255/153',\
1759
1733
  tag:'PCI/12.1',\
1760
- ver:'OWASP_CRS/4.9.0',\
1734
+ ver:'OWASP_CRS/4.16.0',\
1761
1735
  severity:'CRITICAL',\
1762
1736
  setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'"
1763
1737
 
1764
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:920017,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT"
1765
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:920018,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT"
1738
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:920017,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT"
1739
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:920018,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT"
1766
1740
  #
1767
1741
  # -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)
1768
1742
  #
@@ -1784,8 +1758,9 @@ SecRule REQUEST_BASENAME "@endsWith .pdf" \
1784
1758
  tag:'attack-protocol',\
1785
1759
  tag:'paranoia-level/4',\
1786
1760
  tag:'OWASP_CRS',\
1761
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
1787
1762
  tag:'capec/1000/210/272',\
1788
- ver:'OWASP_CRS/4.9.0',\
1763
+ ver:'OWASP_CRS/4.16.0',\
1789
1764
  severity:'WARNING',\
1790
1765
  chain"
1791
1766
  SecRule REQUEST_HEADERS:Range|REQUEST_HEADERS:Request-Range "@rx ^bytes=(?:(?:\d+)?-(?:\d+)?\s*,?\s*){6}" \
@@ -1811,8 +1786,9 @@ SecRule ARGS|ARGS_NAMES|REQUEST_BODY "@validateByteRange 38,44-46,48-58,61,65-90
1811
1786
  tag:'attack-protocol',\
1812
1787
  tag:'paranoia-level/4',\
1813
1788
  tag:'OWASP_CRS',\
1789
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
1814
1790
  tag:'capec/1000/210/272',\
1815
- ver:'OWASP_CRS/4.9.0',\
1791
+ ver:'OWASP_CRS/4.16.0',\
1816
1792
  severity:'CRITICAL',\
1817
1793
  setvar:'tx.inbound_anomaly_score_pl4=+%{tx.critical_anomaly_score}'"
1818
1794
 
@@ -1832,8 +1808,9 @@ SecRule REQUEST_HEADERS|!REQUEST_HEADERS:User-Agent|!REQUEST_HEADERS:Referer|!RE
1832
1808
  tag:'attack-protocol',\
1833
1809
  tag:'paranoia-level/4',\
1834
1810
  tag:'OWASP_CRS',\
1811
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
1835
1812
  tag:'capec/1000/210/272',\
1836
- ver:'OWASP_CRS/4.9.0',\
1813
+ ver:'OWASP_CRS/4.16.0',\
1837
1814
  severity:'CRITICAL',\
1838
1815
  setvar:'tx.inbound_anomaly_score_pl4=+%{tx.critical_anomaly_score}'"
1839
1816
 
@@ -1858,8 +1835,9 @@ SecRule REQUEST_HEADERS:Sec-Fetch-User|REQUEST_HEADERS:Sec-CH-UA-Mobile "!@rx ^(
1858
1835
  tag:'attack-protocol',\
1859
1836
  tag:'paranoia-level/4',\
1860
1837
  tag:'OWASP_CRS',\
1838
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
1861
1839
  tag:'capec/1000/210/272',\
1862
- ver:'OWASP_CRS/4.9.0',\
1840
+ ver:'OWASP_CRS/4.16.0',\
1863
1841
  severity:'CRITICAL',\
1864
1842
  setvar:'tx.inbound_anomaly_score_pl4=+%{tx.critical_anomaly_score}'"
1865
1843
 
@@ -1902,8 +1880,9 @@ SecRule REQUEST_URI|REQUEST_HEADERS|ARGS|ARGS_NAMES "@rx (?:^|[^\x5c])\x5c[cdegh
1902
1880
  tag:'attack-protocol',\
1903
1881
  tag:'paranoia-level/4',\
1904
1882
  tag:'OWASP_CRS',\
1883
+ tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT',\
1905
1884
  tag:'capec/1000/153/267',\
1906
- ver:'OWASP_CRS/4.9.0',\
1885
+ ver:'OWASP_CRS/4.16.0',\
1907
1886
  severity:'CRITICAL',\
1908
1887
  setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\
1909
1888
  setvar:'tx.inbound_anomaly_score_pl4=+%{tx.critical_anomaly_score}'"