@abtnode/router-provider 1.16.45 → 1.16.46-beta-20250703-050038-4ba2582f

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (34) hide show
  1. package/lib/nginx/includes/security/crs4/rules/REQUEST-901-INITIALIZATION.conf +42 -40
  2. package/lib/nginx/includes/security/crs4/rules/REQUEST-905-COMMON-EXCEPTIONS.conf +4 -4
  3. package/lib/nginx/includes/security/crs4/rules/REQUEST-911-METHOD-ENFORCEMENT.conf +12 -11
  4. package/lib/nginx/includes/security/crs4/rules/REQUEST-913-SCANNER-DETECTION.conf +12 -11
  5. package/lib/nginx/includes/security/crs4/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf +127 -148
  6. package/lib/nginx/includes/security/crs4/rules/REQUEST-921-PROTOCOL-ATTACK.conf +80 -35
  7. package/lib/nginx/includes/security/crs4/rules/REQUEST-922-MULTIPART-ATTACK.conf +12 -6
  8. package/lib/nginx/includes/security/crs4/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf +22 -17
  9. package/lib/nginx/includes/security/crs4/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf +20 -15
  10. package/lib/nginx/includes/security/crs4/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf +254 -86
  11. package/lib/nginx/includes/security/crs4/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf +172 -65
  12. package/lib/nginx/includes/security/crs4/rules/REQUEST-934-APPLICATION-ATTACK-GENERIC.conf +65 -29
  13. package/lib/nginx/includes/security/crs4/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf +114 -78
  14. package/lib/nginx/includes/security/crs4/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf +182 -120
  15. package/lib/nginx/includes/security/crs4/rules/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.conf +19 -16
  16. package/lib/nginx/includes/security/crs4/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf +48 -34
  17. package/lib/nginx/includes/security/crs4/rules/REQUEST-949-BLOCKING-EVALUATION.conf +30 -30
  18. package/lib/nginx/includes/security/crs4/rules/RESPONSE-950-DATA-LEAKAGES.conf +20 -15
  19. package/lib/nginx/includes/security/crs4/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf +47 -29
  20. package/lib/nginx/includes/security/crs4/rules/RESPONSE-952-DATA-LEAKAGES-JAVA.conf +15 -36
  21. package/lib/nginx/includes/security/crs4/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf +20 -15
  22. package/lib/nginx/includes/security/crs4/rules/RESPONSE-954-DATA-LEAKAGES-IIS.conf +22 -17
  23. package/lib/nginx/includes/security/crs4/rules/RESPONSE-955-WEB-SHELLS.conf +92 -43
  24. package/lib/nginx/includes/security/crs4/rules/RESPONSE-959-BLOCKING-EVALUATION.conf +30 -30
  25. package/lib/nginx/includes/security/crs4/rules/RESPONSE-980-CORRELATION.conf +23 -23
  26. package/lib/nginx/includes/security/crs4/rules/java-classes.data +11 -0
  27. package/lib/nginx/includes/security/crs4/rules/lfi-os-files.data +227 -15
  28. package/lib/nginx/includes/security/crs4/rules/php-function-names-933150.data +0 -7
  29. package/lib/nginx/includes/security/crs4/rules/restricted-files.data +250 -29
  30. package/lib/nginx/includes/security/crs4/rules/restricted-upload.data +200 -26
  31. package/lib/nginx/includes/security/crs4/rules/unix-shell-builtins.data +20 -0
  32. package/lib/nginx/includes/security/crs4/rules/unix-shell.data +39 -18
  33. package/lib/nginx/includes/security/crs4/rules/web-shells-asp.data +23 -0
  34. package/package.json +7 -7
package/lib/nginx/includes/security/crs4/rules/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.conf CHANGED
@@ -1,7 +1,7 @@
1
1
  # ------------------------------------------------------------------------
2
- # OWASP CRS ver.4.9.0
2
+ # OWASP CRS ver.4.16.0
3
3
  # Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
4
- # Copyright (c) 2021-2024 CRS project. All rights reserved.
4
+ # Copyright (c) 2021-2025 CRS project. All rights reserved.
5
5
  #
6
6
  # The OWASP CRS is distributed under
7
7
  # Apache Software License (ASL) version 2
@@ -14,8 +14,8 @@
14
14
 
15
15
 
16
16
 
17
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:943011,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION"
18
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:943012,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION"
17
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:943011,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION"
18
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:943012,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION"
19
19
  #
20
20
  # -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)
21
21
  #
@@ -28,7 +28,7 @@ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:943012,phase:2,pass,nolog,tag:'O
28
28
  # http://projects.webappsec.org/w/page/13246960/Session%20Fixation
29
29
  # http://capec.mitre.org/data/definitions/61.html
30
30
  #
31
- SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:\.cookie\b.*?;\W*?(?:expires|domain)\W*?=|\bhttp-equiv\W+set-cookie\b)" \
31
+ SecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:\.cookie\b.*?;\W*?(?:expires|domain)\W*?=|\bhttp-equiv\W+set-cookie\b)" \
32
32
  "id:943100,\
33
33
  phase:2,\
34
34
  block,\
@@ -42,14 +42,15 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME
42
42
  tag:'attack-fixation',\
43
43
  tag:'paranoia-level/1',\
44
44
  tag:'OWASP_CRS',\
45
+ tag:'OWASP_CRS/ATTACK-SESSION-FIXATION',\
45
46
  tag:'capec/1000/225/21/593/61',\
46
- ver:'OWASP_CRS/4.9.0',\
47
+ ver:'OWASP_CRS/4.16.0',\
47
48
  severity:'CRITICAL',\
48
49
  setvar:'tx.session_fixation_score=+%{tx.critical_anomaly_score}',\
49
50
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
50
51
 
51
52
 
52
- SecRule ARGS_NAMES "@rx ^(?:jsessionid|aspsessionid|asp\.net_sessionid|phpsession|phpsessid|weblogicsession|session_id|session-id|cfid|cftoken|cfsid|jservsession|jwsession)$" \
53
+ SecRule ARGS_NAMES "@rx ^(?:jsessionid|aspsessionid|asp\.net_sessionid|phpsession|phpsessid|weblogicsession|session_id|session-id|sessionid|cfid|cftoken|cfsid|jservsession|jwsession|_flask_session|_session_id|connect\.sid|laravel_session)$" \
53
54
  "id:943110,\
54
55
  phase:2,\
55
56
  block,\
@@ -63,8 +64,9 @@ SecRule ARGS_NAMES "@rx ^(?:jsessionid|aspsessionid|asp\.net_sessionid|phpsessio
63
64
  tag:'attack-fixation',\
64
65
  tag:'paranoia-level/1',\
65
66
  tag:'OWASP_CRS',\
67
+ tag:'OWASP_CRS/ATTACK-SESSION-FIXATION',\
66
68
  tag:'capec/1000/225/21/593/61',\
67
- ver:'OWASP_CRS/4.9.0',\
69
+ ver:'OWASP_CRS/4.16.0',\
68
70
  severity:'CRITICAL',\
69
71
  setvar:'tx.943110_matched_var_name=%{matched_var_name}',\
70
72
  chain"
@@ -76,7 +78,7 @@ SecRule ARGS_NAMES "@rx ^(?:jsessionid|aspsessionid|asp\.net_sessionid|phpsessio
76
78
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
77
79
 
78
80
 
79
- SecRule ARGS_NAMES "@rx ^(?:jsessionid|aspsessionid|asp\.net_sessionid|phpsession|phpsessid|weblogicsession|session_id|session-id|cfid|cftoken|cfsid|jservsession|jwsession)$" \
81
+ SecRule ARGS_NAMES "@rx ^(?:jsessionid|aspsessionid|asp\.net_sessionid|phpsession|phpsessid|weblogicsession|session_id|session-id|sessionid|cfid|cftoken|cfsid|jservsession|jwsession|_flask_session|_session_id|connect\.sid|laravel_session)$" \
80
82
  "id:943120,\
81
83
  phase:2,\
82
84
  block,\
@@ -90,8 +92,9 @@ SecRule ARGS_NAMES "@rx ^(?:jsessionid|aspsessionid|asp\.net_sessionid|phpsessio
90
92
  tag:'attack-fixation',\
91
93
  tag:'paranoia-level/1',\
92
94
  tag:'OWASP_CRS',\
95
+ tag:'OWASP_CRS/ATTACK-SESSION-FIXATION',\
93
96
  tag:'capec/1000/225/21/593/61',\
94
- ver:'OWASP_CRS/4.9.0',\
97
+ ver:'OWASP_CRS/4.16.0',\
95
98
  severity:'CRITICAL',\
96
99
  setvar:'tx.943120_matched_var_name=%{matched_var_name}',\
97
100
  chain"
@@ -102,24 +105,24 @@ SecRule ARGS_NAMES "@rx ^(?:jsessionid|aspsessionid|asp\.net_sessionid|phpsessio
102
105
 
103
106
 
104
107
 
105
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:943013,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION"
106
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:943014,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION"
108
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:943013,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION"
109
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:943014,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION"
107
110
  #
108
111
  # -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)
109
112
  #
110
113
 
111
114
 
112
115
 
113
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:943015,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION"
114
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:943016,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION"
116
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:943015,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION"
117
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:943016,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION"
115
118
  #
116
119
  # -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)
117
120
  #
118
121
 
119
122
 
120
123
 
121
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:943017,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION"
122
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:943018,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION"
124
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:943017,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION"
125
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:943018,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION"
123
126
  #
124
127
  # -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)
125
128
  #
package/lib/nginx/includes/security/crs4/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf CHANGED
@@ -1,7 +1,7 @@
1
1
  # ------------------------------------------------------------------------
2
- # OWASP CRS ver.4.9.0
2
+ # OWASP CRS ver.4.16.0
3
3
  # Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
4
- # Copyright (c) 2021-2024 CRS project. All rights reserved.
4
+ # Copyright (c) 2021-2025 CRS project. All rights reserved.
5
5
  #
6
6
  # The OWASP CRS is distributed under
7
7
  # Apache Software License (ASL) version 2
@@ -13,8 +13,8 @@
13
13
  #
14
14
  # Many rules check request bodies, use "SecRequestBodyAccess On" to enable it on main modsecurity configuration file.
15
15
 
16
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:944011,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA"
17
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:944012,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA"
16
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:944011,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA"
17
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:944012,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA"
18
18
  #
19
19
  # -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)
20
20
  #
@@ -30,7 +30,7 @@ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:944012,phase:2,pass,nolog,tag:'O
30
30
  # This rule is also triggered by an Oracle WebLogic Remote Command Execution exploit:
31
31
  # [ Oracle WebLogic vulnerability CVE-2017-10271 - Exploit tested: https://www.exploit-db.com/exploits/43458 ]
32
32
  #
33
- SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \
33
+ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \
34
34
  "@rx java\.lang\.(?:runtime|processbuilder)" \
35
35
  "id:944100,\
36
36
  phase:2,\
@@ -44,9 +44,10 @@ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES
44
44
  tag:'attack-rce',\
45
45
  tag:'paranoia-level/1',\
46
46
  tag:'OWASP_CRS',\
47
+ tag:'OWASP_CRS/ATTACK-JAVA',\
47
48
  tag:'capec/1000/152/137/6',\
48
49
  tag:'PCI/6.5.2',\
49
- ver:'OWASP_CRS/4.9.0',\
50
+ ver:'OWASP_CRS/4.16.0',\
50
51
  severity:'CRITICAL',\
51
52
  setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
52
53
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
@@ -63,7 +64,7 @@ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES
63
64
  # java. unmarshaller or base64data to trigger a potential payload execution
64
65
  # tested with https://www.exploit-db.com/exploits/42627/ and https://www.exploit-db.com/exploits/43458/
65
66
 
66
- SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* "@rx (?:runtime|processbuilder)" \
67
+ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* "@rx (?:runtime|processbuilder)" \
67
68
  "id:944110,\
68
69
  phase:2,\
69
70
  block,\
@@ -76,9 +77,10 @@ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES
76
77
  tag:'attack-rce',\
77
78
  tag:'paranoia-level/1',\
78
79
  tag:'OWASP_CRS',\
80
+ tag:'OWASP_CRS/ATTACK-JAVA',\
79
81
  tag:'capec/1000/152/248',\
80
82
  tag:'PCI/6.5.2',\
81
- ver:'OWASP_CRS/4.9.0',\
83
+ ver:'OWASP_CRS/4.16.0',\
82
84
  severity:'CRITICAL',\
83
85
  chain"
84
86
  SecRule MATCHED_VARS|XML:/*|XML://@* "@rx (?i)(?:unmarshaller|base64data|java\.)" \
@@ -87,7 +89,7 @@ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES
87
89
 
88
90
  # Magic bytes detected and payload included possibly RCE vulnerable classes detected and process execution methods detected
89
91
  # anomaly score set to critical as all conditions indicate the request try to perform RCE.
90
- SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \
92
+ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \
91
93
  "@rx (?:clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder)" \
92
94
  "id:944120,\
93
95
  phase:2,\
@@ -101,9 +103,10 @@ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES
101
103
  tag:'attack-rce',\
102
104
  tag:'paranoia-level/1',\
103
105
  tag:'OWASP_CRS',\
106
+ tag:'OWASP_CRS/ATTACK-JAVA',\
104
107
  tag:'capec/1000/152/248',\
105
108
  tag:'PCI/6.5.2',\
106
- ver:'OWASP_CRS/4.9.0',\
109
+ ver:'OWASP_CRS/4.16.0',\
107
110
  severity:'CRITICAL',\
108
111
  chain"
109
112
  SecRule MATCHED_VARS "@rx (?:runtime|processbuilder)" \
@@ -119,7 +122,7 @@ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES
119
122
  # [ Apache Struts vulnerability CVE-2018-11776 - Exploit tested: https://www.exploit-db.com/exploits/45262 ]
120
123
  # [ Apache Struts vulnerability CVE-2018-11776 - Exploit tested: https://www.exploit-db.com/exploits/45260 ]
121
124
  #
122
- SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_FILENAME|REQUEST_HEADERS|XML:/*|XML://@* \
125
+ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_FILENAME|REQUEST_HEADERS|XML:/*|XML://@* \
123
126
  "@pmFromFile java-classes.data" \
124
127
  "id:944130,\
125
128
  phase:2,\
@@ -133,9 +136,10 @@ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES
133
136
  tag:'attack-rce',\
134
137
  tag:'paranoia-level/1',\
135
138
  tag:'OWASP_CRS',\
139
+ tag:'OWASP_CRS/ATTACK-JAVA',\
136
140
  tag:'capec/1000/152/248',\
137
141
  tag:'PCI/6.5.2',\
138
- ver:'OWASP_CRS/4.9.0',\
142
+ ver:'OWASP_CRS/4.16.0',\
139
143
  severity:'CRITICAL',\
140
144
  setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
141
145
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
@@ -172,8 +176,9 @@ SecRule FILES|REQUEST_HEADERS:X-Filename|REQUEST_HEADERS:X_Filename|REQUEST_HEAD
172
176
  tag:'attack-injection-java',\
173
177
  tag:'paranoia-level/1',\
174
178
  tag:'OWASP_CRS',\
179
+ tag:'OWASP_CRS/ATTACK-JAVA',\
175
180
  tag:'capec/1000/152/242',\
176
- ver:'OWASP_CRS/4.9.0',\
181
+ ver:'OWASP_CRS/4.16.0',\
177
182
  severity:'CRITICAL',\
178
183
  setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
179
184
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
@@ -219,16 +224,17 @@ SecRule REQUEST_LINE|ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUE
219
224
  tag:'attack-rce',\
220
225
  tag:'paranoia-level/1',\
221
226
  tag:'OWASP_CRS',\
227
+ tag:'OWASP_CRS/ATTACK-JAVA',\
222
228
  tag:'capec/1000/152/137/6',\
223
229
  tag:'PCI/6.5.2',\
224
- ver:'OWASP_CRS/4.9.0',\
230
+ ver:'OWASP_CRS/4.16.0',\
225
231
  severity:'CRITICAL',\
226
232
  setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
227
233
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
228
234
 
229
235
 
230
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:944013,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA"
231
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:944014,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA"
236
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:944013,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA"
237
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:944014,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA"
232
238
  #
233
239
  # -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)
234
240
  #
@@ -257,9 +263,10 @@ SecRule REQUEST_LINE|ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUE
257
263
  tag:'attack-rce',\
258
264
  tag:'paranoia-level/2',\
259
265
  tag:'OWASP_CRS',\
266
+ tag:'OWASP_CRS/ATTACK-JAVA',\
260
267
  tag:'capec/1000/152/137/6',\
261
268
  tag:'PCI/6.5.2',\
262
- ver:'OWASP_CRS/4.9.0',\
269
+ ver:'OWASP_CRS/4.16.0',\
263
270
  severity:'CRITICAL',\
264
271
  setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
265
272
  setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
@@ -276,7 +283,7 @@ SecRule REQUEST_LINE|ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUE
276
283
  # https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet
277
284
  #
278
285
  # Potential false positives with random fields, the anomaly level is set low to avoid blocking request
279
- SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \
286
+ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \
280
287
  "@rx \xac\xed\x00\x05" \
281
288
  "id:944200,\
282
289
  phase:2,\
@@ -289,15 +296,16 @@ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES
289
296
  tag:'attack-rce',\
290
297
  tag:'paranoia-level/2',\
291
298
  tag:'OWASP_CRS',\
299
+ tag:'OWASP_CRS/ATTACK-JAVA',\
292
300
  tag:'capec/1000/152/248',\
293
301
  tag:'PCI/6.5.2',\
294
- ver:'OWASP_CRS/4.9.0',\
302
+ ver:'OWASP_CRS/4.16.0',\
295
303
  severity:'CRITICAL',\
296
304
  setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
297
305
  setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
298
306
 
299
307
  # Detecting possible base64 text to match encoded magic bytes \xac\xed\x00\x05 with padding encoded in base64 strings are rO0ABQ KztAAU Cs7QAF
300
- SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \
308
+ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \
301
309
  "@rx (?:rO0ABQ|KztAAU|Cs7QAF)" \
302
310
  "id:944210,\
303
311
  phase:2,\
@@ -310,14 +318,15 @@ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES
310
318
  tag:'attack-rce',\
311
319
  tag:'paranoia-level/2',\
312
320
  tag:'OWASP_CRS',\
321
+ tag:'OWASP_CRS/ATTACK-JAVA',\
313
322
  tag:'capec/1000/152/248',\
314
323
  tag:'PCI/6.5.2',\
315
- ver:'OWASP_CRS/4.9.0',\
324
+ ver:'OWASP_CRS/4.16.0',\
316
325
  severity:'CRITICAL',\
317
326
  setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
318
327
  setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
319
328
 
320
- SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \
329
+ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \
321
330
  "@rx (?:clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder)" \
322
331
  "id:944240,\
323
332
  phase:2,\
@@ -331,9 +340,10 @@ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES
331
340
  tag:'attack-rce',\
332
341
  tag:'paranoia-level/2',\
333
342
  tag:'OWASP_CRS',\
343
+ tag:'OWASP_CRS/ATTACK-JAVA',\
334
344
  tag:'capec/1000/152/248',\
335
345
  tag:'PCI/6.5.2',\
336
- ver:'OWASP_CRS/4.9.0',\
346
+ ver:'OWASP_CRS/4.16.0',\
337
347
  severity:'CRITICAL',\
338
348
  setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
339
349
  setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
@@ -341,7 +351,7 @@ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES
341
351
  # This rule is also triggered by the following exploit(s):
342
352
  # [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]
343
353
  #
344
- SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \
354
+ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \
345
355
  "@rx java\b.+(?:runtime|processbuilder)" \
346
356
  "id:944250,\
347
357
  phase:2,\
@@ -355,9 +365,10 @@ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES
355
365
  tag:'attack-rce',\
356
366
  tag:'paranoia-level/2',\
357
367
  tag:'OWASP_CRS',\
368
+ tag:'OWASP_CRS/ATTACK-JAVA',\
358
369
  tag:'capec/1000/152/248',\
359
370
  tag:'PCI/6.5.2',\
360
- ver:'OWASP_CRS/4.9.0',\
371
+ ver:'OWASP_CRS/4.16.0',\
361
372
  severity:'CRITICAL',\
362
373
  setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
363
374
  setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
@@ -366,7 +377,7 @@ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES
366
377
  # This rule is also triggered by the following exploit(s):
367
378
  # - https://www.rapid7.com/blog/post/2022/03/30/spring4shell-zero-day-vulnerability-in-spring-framework/
368
379
  #
369
- SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \
380
+ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \
370
381
  "@rx (?:class\.module\.classLoader\.resources\.context\.parent\.pipeline|springframework\.context\.support\.FileSystemXmlApplicationContext)" \
371
382
  "id:944260,\
372
383
  phase:2,\
@@ -380,16 +391,17 @@ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES
380
391
  tag:'attack-rce',\
381
392
  tag:'paranoia-level/2',\
382
393
  tag:'OWASP_CRS',\
394
+ tag:'OWASP_CRS/ATTACK-JAVA',\
383
395
  tag:'capec/1000/152/248',\
384
396
  tag:'PCI/6.5.2',\
385
- ver:'OWASP_CRS/4.9.0',\
397
+ ver:'OWASP_CRS/4.16.0',\
386
398
  severity:'CRITICAL',\
387
399
  setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
388
400
  setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
389
401
 
390
402
 
391
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:944015,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA"
392
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:944016,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA"
403
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:944015,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA"
404
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:944016,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA"
393
405
  #
394
406
  # -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)
395
407
  #
@@ -400,7 +412,7 @@ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:944016,phase:2,pass,nolog,tag:'O
400
412
  # for padding in xrange(3):
401
413
  # print base64.b64encode(''.join([pad*padding,item])).replace('=','')[padding:],
402
414
  #cnVudGltZQ HJ1bnRpbWU BydW50aW1l cHJvY2Vzc2J1aWxkZXI HByb2Nlc3NidWlsZGVy Bwcm9jZXNzYnVpbGRlcg Y2xvbmV0cmFuc2Zvcm1lcg GNsb25ldHJhbnNmb3JtZXI BjbG9uZXRyYW5zZm9ybWVy Zm9yY2xvc3VyZQ GZvcmNsb3N1cmU Bmb3JjbG9zdXJl aW5zdGFudGlhdGVmYWN0b3J5 Gluc3RhbnRpYXRlZmFjdG9yeQ BpbnN0YW50aWF0ZWZhY3Rvcnk aW5zdGFudGlhdGV0cmFuc2Zvcm1lcg Gluc3RhbnRpYXRldHJhbnNmb3JtZXI BpbnN0YW50aWF0ZXRyYW5zZm9ybWVy aW52b2tlcnRyYW5zZm9ybWVy Gludm9rZXJ0cmFuc2Zvcm1lcg BpbnZva2VydHJhbnNmb3JtZXI cHJvdG90eXBlY2xvbmVmYWN0b3J5 HByb3RvdHlwZWNsb25lZmFjdG9yeQ Bwcm90b3R5cGVjbG9uZWZhY3Rvcnk cHJvdG90eXBlc2VyaWFsaXphdGlvbmZhY3Rvcnk HByb3RvdHlwZXNlcmlhbGl6YXRpb25mYWN0b3J5 Bwcm90b3R5cGVzZXJpYWxpemF0aW9uZmFjdG9yeQ d2hpbGVjbG9zdXJl HdoaWxlY2xvc3VyZQ B3aGlsZWNsb3N1cmU
403
- SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \
415
+ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \
404
416
  "@rx (?:cnVudGltZQ|HJ1bnRpbWU|BydW50aW1l|cHJvY2Vzc2J1aWxkZXI|HByb2Nlc3NidWlsZGVy|Bwcm9jZXNzYnVpbGRlcg|Y2xvbmV0cmFuc2Zvcm1lcg|GNsb25ldHJhbnNmb3JtZXI|BjbG9uZXRyYW5zZm9ybWVy|Zm9yY2xvc3VyZQ|GZvcmNsb3N1cmU|Bmb3JjbG9zdXJl|aW5zdGFudGlhdGVmYWN0b3J5|Gluc3RhbnRpYXRlZmFjdG9yeQ|BpbnN0YW50aWF0ZWZhY3Rvcnk|aW5zdGFudGlhdGV0cmFuc2Zvcm1lcg|Gluc3RhbnRpYXRldHJhbnNmb3JtZXI|BpbnN0YW50aWF0ZXRyYW5zZm9ybWVy|aW52b2tlcnRyYW5zZm9ybWVy|Gludm9rZXJ0cmFuc2Zvcm1lcg|BpbnZva2VydHJhbnNmb3JtZXI|cHJvdG90eXBlY2xvbmVmYWN0b3J5|HByb3RvdHlwZWNsb25lZmFjdG9yeQ|Bwcm90b3R5cGVjbG9uZWZhY3Rvcnk|cHJvdG90eXBlc2VyaWFsaXphdGlvbmZhY3Rvcnk|HByb3RvdHlwZXNlcmlhbGl6YXRpb25mYWN0b3J5|Bwcm90b3R5cGVzZXJpYWxpemF0aW9uZmFjdG9yeQ|d2hpbGVjbG9zdXJl|HdoaWxlY2xvc3VyZQ|B3aGlsZWNsb3N1cmU)" \
405
417
  "id:944300,\
406
418
  phase:2,\
@@ -414,16 +426,17 @@ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES
414
426
  tag:'attack-rce',\
415
427
  tag:'paranoia-level/3',\
416
428
  tag:'OWASP_CRS',\
429
+ tag:'OWASP_CRS/ATTACK-JAVA',\
417
430
  tag:'capec/1000/152/248',\
418
431
  tag:'PCI/6.5.2',\
419
- ver:'OWASP_CRS/4.9.0',\
432
+ ver:'OWASP_CRS/4.16.0',\
420
433
  severity:'CRITICAL',\
421
434
  setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
422
435
  setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'"
423
436
 
424
437
 
425
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:944017,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA"
426
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:944018,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA"
438
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:944017,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA"
439
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:944018,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA"
427
440
  #
428
441
  # -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)
429
442
  #
@@ -450,9 +463,10 @@ SecRule REQUEST_LINE|ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUE
450
463
  tag:'attack-rce',\
451
464
  tag:'paranoia-level/4',\
452
465
  tag:'OWASP_CRS',\
466
+ tag:'OWASP_CRS/ATTACK-JAVA',\
453
467
  tag:'capec/1000/152/137/6',\
454
468
  tag:'PCI/6.5.2',\
455
- ver:'OWASP_CRS/4.9.0',\
469
+ ver:'OWASP_CRS/4.16.0',\
456
470
  severity:'CRITICAL',\
457
471
  setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
458
472
  setvar:'tx.inbound_anomaly_score_pl4=+%{tx.critical_anomaly_score}'"
package/lib/nginx/includes/security/crs4/rules/REQUEST-949-BLOCKING-EVALUATION.conf CHANGED
@@ -1,7 +1,7 @@
1
1
  # ------------------------------------------------------------------------
2
- # OWASP CRS ver.4.9.0
2
+ # OWASP CRS ver.4.16.0
3
3
  # Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
4
- # Copyright (c) 2021-2024 CRS project. All rights reserved.
4
+ # Copyright (c) 2021-2025 CRS project. All rights reserved.
5
5
  #
6
6
  # The OWASP CRS is distributed under
7
7
  # Apache Software License (ASL) version 2
@@ -24,7 +24,7 @@ SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 1" \
24
24
  t:none,\
25
25
  nolog,\
26
26
  tag:'OWASP_CRS',\
27
- ver:'OWASP_CRS/4.9.0',\
27
+ ver:'OWASP_CRS/4.16.0',\
28
28
  setvar:'tx.blocking_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl1}'"
29
29
 
30
30
  SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 1" \
@@ -34,7 +34,7 @@ SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 1" \
34
34
  t:none,\
35
35
  nolog,\
36
36
  tag:'OWASP_CRS',\
37
- ver:'OWASP_CRS/4.9.0',\
37
+ ver:'OWASP_CRS/4.16.0',\
38
38
  setvar:'tx.detection_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl1}'"
39
39
 
40
40
  SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 2" \
@@ -44,7 +44,7 @@ SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 2" \
44
44
  t:none,\
45
45
  nolog,\
46
46
  tag:'OWASP_CRS',\
47
- ver:'OWASP_CRS/4.9.0',\
47
+ ver:'OWASP_CRS/4.16.0',\
48
48
  setvar:'tx.blocking_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl2}'"
49
49
 
50
50
  SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 2" \
@@ -54,7 +54,7 @@ SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 2" \
54
54
  t:none,\
55
55
  nolog,\
56
56
  tag:'OWASP_CRS',\
57
- ver:'OWASP_CRS/4.9.0',\
57
+ ver:'OWASP_CRS/4.16.0',\
58
58
  setvar:'tx.detection_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl2}'"
59
59
 
60
60
  SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 3" \
@@ -64,7 +64,7 @@ SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 3" \
64
64
  t:none,\
65
65
  nolog,\
66
66
  tag:'OWASP_CRS',\
67
- ver:'OWASP_CRS/4.9.0',\
67
+ ver:'OWASP_CRS/4.16.0',\
68
68
  setvar:'tx.blocking_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl3}'"
69
69
 
70
70
  SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 3" \
@@ -74,7 +74,7 @@ SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 3" \
74
74
  t:none,\
75
75
  nolog,\
76
76
  tag:'OWASP_CRS',\
77
- ver:'OWASP_CRS/4.9.0',\
77
+ ver:'OWASP_CRS/4.16.0',\
78
78
  setvar:'tx.detection_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl3}'"
79
79
 
80
80
  SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 4" \
@@ -84,7 +84,7 @@ SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 4" \
84
84
  t:none,\
85
85
  nolog,\
86
86
  tag:'OWASP_CRS',\
87
- ver:'OWASP_CRS/4.9.0',\
87
+ ver:'OWASP_CRS/4.16.0',\
88
88
  setvar:'tx.blocking_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl4}'"
89
89
 
90
90
  SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 4" \
@@ -94,7 +94,7 @@ SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 4" \
94
94
  t:none,\
95
95
  nolog,\
96
96
  tag:'OWASP_CRS',\
97
- ver:'OWASP_CRS/4.9.0',\
97
+ ver:'OWASP_CRS/4.16.0',\
98
98
  setvar:'tx.detection_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl4}'"
99
99
 
100
100
  # at start of phase 2, we reset the aggregate scores to 0 to prevent duplicate counting of per-PL scores
@@ -106,7 +106,7 @@ SecAction \
106
106
  t:none,\
107
107
  nolog,\
108
108
  tag:'OWASP_CRS',\
109
- ver:'OWASP_CRS/4.9.0',\
109
+ ver:'OWASP_CRS/4.16.0',\
110
110
  setvar:'tx.blocking_inbound_anomaly_score=0'"
111
111
 
112
112
  SecAction \
@@ -116,7 +116,7 @@ SecAction \
116
116
  t:none,\
117
117
  nolog,\
118
118
  tag:'OWASP_CRS',\
119
- ver:'OWASP_CRS/4.9.0',\
119
+ ver:'OWASP_CRS/4.16.0',\
120
120
  setvar:'tx.detection_inbound_anomaly_score=0'"
121
121
 
122
122
  # Summing up the blocking and detection anomaly scores in phase 2
@@ -128,7 +128,7 @@ SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 1" \
128
128
  t:none,\
129
129
  nolog,\
130
130
  tag:'OWASP_CRS',\
131
- ver:'OWASP_CRS/4.9.0',\
131
+ ver:'OWASP_CRS/4.16.0',\
132
132
  setvar:'tx.blocking_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl1}'"
133
133
 
134
134
  SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 1" \
@@ -138,7 +138,7 @@ SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 1" \
138
138
  t:none,\
139
139
  nolog,\
140
140
  tag:'OWASP_CRS',\
141
- ver:'OWASP_CRS/4.9.0',\
141
+ ver:'OWASP_CRS/4.16.0',\
142
142
  setvar:'tx.detection_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl1}'"
143
143
 
144
144
  SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 2" \
@@ -148,7 +148,7 @@ SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 2" \
148
148
  t:none,\
149
149
  nolog,\
150
150
  tag:'OWASP_CRS',\
151
- ver:'OWASP_CRS/4.9.0',\
151
+ ver:'OWASP_CRS/4.16.0',\
152
152
  setvar:'tx.blocking_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl2}'"
153
153
 
154
154
  SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 2" \
@@ -158,7 +158,7 @@ SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 2" \
158
158
  t:none,\
159
159
  nolog,\
160
160
  tag:'OWASP_CRS',\
161
- ver:'OWASP_CRS/4.9.0',\
161
+ ver:'OWASP_CRS/4.16.0',\
162
162
  setvar:'tx.detection_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl2}'"
163
163
 
164
164
  SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 3" \
@@ -168,7 +168,7 @@ SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 3" \
168
168
  t:none,\
169
169
  nolog,\
170
170
  tag:'OWASP_CRS',\
171
- ver:'OWASP_CRS/4.9.0',\
171
+ ver:'OWASP_CRS/4.16.0',\
172
172
  setvar:'tx.blocking_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl3}'"
173
173
 
174
174
  SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 3" \
@@ -178,7 +178,7 @@ SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 3" \
178
178
  t:none,\
179
179
  nolog,\
180
180
  tag:'OWASP_CRS',\
181
- ver:'OWASP_CRS/4.9.0',\
181
+ ver:'OWASP_CRS/4.16.0',\
182
182
  setvar:'tx.detection_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl3}'"
183
183
 
184
184
  SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 4" \
@@ -188,7 +188,7 @@ SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 4" \
188
188
  t:none,\
189
189
  nolog,\
190
190
  tag:'OWASP_CRS',\
191
- ver:'OWASP_CRS/4.9.0',\
191
+ ver:'OWASP_CRS/4.16.0',\
192
192
  setvar:'tx.blocking_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl4}'"
193
193
 
194
194
  SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 4" \
@@ -198,7 +198,7 @@ SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 4" \
198
198
  t:none,\
199
199
  nolog,\
200
200
  tag:'OWASP_CRS',\
201
- ver:'OWASP_CRS/4.9.0',\
201
+ ver:'OWASP_CRS/4.16.0',\
202
202
  setvar:'tx.detection_inbound_anomaly_score=+%{tx.inbound_anomaly_score_pl4}'"
203
203
 
204
204
 
@@ -217,7 +217,7 @@ SecRule TX:BLOCKING_INBOUND_ANOMALY_SCORE "@ge %{tx.inbound_anomaly_score_thresh
217
217
  msg:'Inbound Anomaly Score Exceeded in phase 1 (Total Score: %{TX.BLOCKING_INBOUND_ANOMALY_SCORE})',\
218
218
  tag:'anomaly-evaluation',\
219
219
  tag:'OWASP_CRS',\
220
- ver:'OWASP_CRS/4.9.0',\
220
+ ver:'OWASP_CRS/4.16.0',\
221
221
  chain"
222
222
  SecRule TX:EARLY_BLOCKING "@eq 1"
223
223
 
@@ -230,34 +230,34 @@ SecRule TX:BLOCKING_INBOUND_ANOMALY_SCORE "@ge %{tx.inbound_anomaly_score_thresh
230
230
  msg:'Inbound Anomaly Score Exceeded (Total Score: %{TX.BLOCKING_INBOUND_ANOMALY_SCORE})',\
231
231
  tag:'anomaly-evaluation',\
232
232
  tag:'OWASP_CRS',\
233
- ver:'OWASP_CRS/4.9.0'"
233
+ ver:'OWASP_CRS/4.16.0'"
234
234
 
235
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:949011,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-949-BLOCKING-EVALUATION"
236
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:949012,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-949-BLOCKING-EVALUATION"
235
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:949011,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-949-BLOCKING-EVALUATION"
236
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:949012,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-949-BLOCKING-EVALUATION"
237
237
  #
238
238
  # -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)
239
239
  #
240
240
 
241
241
 
242
242
 
243
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:949013,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-949-BLOCKING-EVALUATION"
244
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:949014,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-949-BLOCKING-EVALUATION"
243
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:949013,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-949-BLOCKING-EVALUATION"
244
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:949014,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-949-BLOCKING-EVALUATION"
245
245
  #
246
246
  # -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)
247
247
  #
248
248
 
249
249
 
250
250
 
251
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:949015,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-949-BLOCKING-EVALUATION"
252
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:949016,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-949-BLOCKING-EVALUATION"
251
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:949015,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-949-BLOCKING-EVALUATION"
252
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:949016,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-949-BLOCKING-EVALUATION"
253
253
  #
254
254
  # -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)
255
255
  #
256
256
 
257
257
 
258
258
 
259
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:949017,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-949-BLOCKING-EVALUATION"
260
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:949018,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-949-BLOCKING-EVALUATION"
259
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:949017,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-949-BLOCKING-EVALUATION"
260
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:949018,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-949-BLOCKING-EVALUATION"
261
261
  #
262
262
  # -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)
263
263
  #