@abtnode/router-provider 1.16.46-beta-20250703-024219-4029ee97 → 1.16.46-beta-20250703-050038-4ba2582f

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (34) hide show
  1. package/lib/nginx/includes/security/crs4/rules/REQUEST-901-INITIALIZATION.conf +42 -40
  2. package/lib/nginx/includes/security/crs4/rules/REQUEST-905-COMMON-EXCEPTIONS.conf +4 -4
  3. package/lib/nginx/includes/security/crs4/rules/REQUEST-911-METHOD-ENFORCEMENT.conf +12 -11
  4. package/lib/nginx/includes/security/crs4/rules/REQUEST-913-SCANNER-DETECTION.conf +12 -11
  5. package/lib/nginx/includes/security/crs4/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf +127 -148
  6. package/lib/nginx/includes/security/crs4/rules/REQUEST-921-PROTOCOL-ATTACK.conf +80 -35
  7. package/lib/nginx/includes/security/crs4/rules/REQUEST-922-MULTIPART-ATTACK.conf +12 -6
  8. package/lib/nginx/includes/security/crs4/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf +22 -17
  9. package/lib/nginx/includes/security/crs4/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf +20 -15
  10. package/lib/nginx/includes/security/crs4/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf +254 -86
  11. package/lib/nginx/includes/security/crs4/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf +172 -65
  12. package/lib/nginx/includes/security/crs4/rules/REQUEST-934-APPLICATION-ATTACK-GENERIC.conf +65 -29
  13. package/lib/nginx/includes/security/crs4/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf +114 -78
  14. package/lib/nginx/includes/security/crs4/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf +182 -120
  15. package/lib/nginx/includes/security/crs4/rules/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.conf +19 -16
  16. package/lib/nginx/includes/security/crs4/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf +48 -34
  17. package/lib/nginx/includes/security/crs4/rules/REQUEST-949-BLOCKING-EVALUATION.conf +30 -30
  18. package/lib/nginx/includes/security/crs4/rules/RESPONSE-950-DATA-LEAKAGES.conf +20 -15
  19. package/lib/nginx/includes/security/crs4/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf +47 -29
  20. package/lib/nginx/includes/security/crs4/rules/RESPONSE-952-DATA-LEAKAGES-JAVA.conf +15 -36
  21. package/lib/nginx/includes/security/crs4/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf +20 -15
  22. package/lib/nginx/includes/security/crs4/rules/RESPONSE-954-DATA-LEAKAGES-IIS.conf +22 -17
  23. package/lib/nginx/includes/security/crs4/rules/RESPONSE-955-WEB-SHELLS.conf +92 -43
  24. package/lib/nginx/includes/security/crs4/rules/RESPONSE-959-BLOCKING-EVALUATION.conf +30 -30
  25. package/lib/nginx/includes/security/crs4/rules/RESPONSE-980-CORRELATION.conf +23 -23
  26. package/lib/nginx/includes/security/crs4/rules/java-classes.data +11 -0
  27. package/lib/nginx/includes/security/crs4/rules/lfi-os-files.data +227 -15
  28. package/lib/nginx/includes/security/crs4/rules/php-function-names-933150.data +0 -7
  29. package/lib/nginx/includes/security/crs4/rules/restricted-files.data +250 -29
  30. package/lib/nginx/includes/security/crs4/rules/restricted-upload.data +200 -26
  31. package/lib/nginx/includes/security/crs4/rules/unix-shell-builtins.data +20 -0
  32. package/lib/nginx/includes/security/crs4/rules/unix-shell.data +39 -18
  33. package/lib/nginx/includes/security/crs4/rules/web-shells-asp.data +23 -0
  34. package/package.json +7 -7
package/lib/nginx/includes/security/crs4/rules/RESPONSE-954-DATA-LEAKAGES-IIS.conf CHANGED
@@ -1,7 +1,7 @@
1
1
  # ------------------------------------------------------------------------
2
- # OWASP CRS ver.4.9.0
2
+ # OWASP CRS ver.4.16.0
3
3
  # Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
4
- # Copyright (c) 2021-2024 CRS project. All rights reserved.
4
+ # Copyright (c) 2021-2025 CRS project. All rights reserved.
5
5
  #
6
6
  # The OWASP CRS is distributed under
7
7
  # Apache Software License (ASL) version 2
@@ -19,22 +19,23 @@ SecRule RESPONSE_HEADERS:Content-Encoding "@pm gzip compress deflate br zstd" \
19
19
  pass,\
20
20
  nolog,\
21
21
  tag:'OWASP_CRS',\
22
- ver:'OWASP_CRS/4.9.0',\
22
+ tag:'OWASP_CRS/DATA-LEAKAGES-IIS',\
23
+ ver:'OWASP_CRS/4.16.0',\
23
24
  skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS"
24
25
 
25
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:954011,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS"
26
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:954012,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS"
26
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:954011,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS"
27
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:954012,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS"
27
28
  #
28
29
  # -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)
29
30
  #
30
31
 
31
32
  # IIS default location
32
- SecRule RESPONSE_BODY "@rx [a-z]:\x5cinetpub\b" \
33
+ SecRule RESPONSE_BODY "@rx (?i)[a-z]:[\x5c/]inetpub\b" \
33
34
  "id:954100,\
34
35
  phase:4,\
35
36
  block,\
36
37
  capture,\
37
- t:none,t:lowercase,\
38
+ t:none,\
38
39
  msg:'Disclosure of IIS install location',\
39
40
  logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
40
41
  tag:'application-multi',\
@@ -44,8 +45,9 @@ SecRule RESPONSE_BODY "@rx [a-z]:\x5cinetpub\b" \
44
45
  tag:'attack-disclosure',\
45
46
  tag:'paranoia-level/1',\
46
47
  tag:'OWASP_CRS',\
48
+ tag:'OWASP_CRS/DATA-LEAKAGES-IIS',\
47
49
  tag:'capec/1000/118/116',\
48
- ver:'OWASP_CRS/4.9.0',\
50
+ ver:'OWASP_CRS/4.16.0',\
49
51
  severity:'ERROR',\
50
52
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}'"
51
53
 
@@ -64,9 +66,10 @@ SecRule RESPONSE_BODY "@rx (?:Microsoft OLE DB Provider for SQL Server(?:</font>
64
66
  tag:'attack-disclosure',\
65
67
  tag:'paranoia-level/1',\
66
68
  tag:'OWASP_CRS',\
69
+ tag:'OWASP_CRS/DATA-LEAKAGES-IIS',\
67
70
  tag:'capec/1000/118/116',\
68
71
  tag:'PCI/6.5.6',\
69
- ver:'OWASP_CRS/4.9.0',\
72
+ ver:'OWASP_CRS/4.16.0',\
70
73
  severity:'ERROR',\
71
74
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}'"
72
75
 
@@ -88,9 +91,10 @@ SecRule RESPONSE_BODY "@pmFromFile iis-errors.data" \
88
91
  tag:'attack-disclosure',\
89
92
  tag:'paranoia-level/1',\
90
93
  tag:'OWASP_CRS',\
94
+ tag:'OWASP_CRS/DATA-LEAKAGES-IIS',\
91
95
  tag:'capec/1000/118/116',\
92
96
  tag:'PCI/6.5.6',\
93
- ver:'OWASP_CRS/4.9.0',\
97
+ ver:'OWASP_CRS/4.16.0',\
94
98
  severity:'ERROR',\
95
99
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}'"
96
100
 
@@ -110,9 +114,10 @@ SecRule RESPONSE_STATUS "!@rx ^404$" \
110
114
  tag:'attack-disclosure',\
111
115
  tag:'paranoia-level/1',\
112
116
  tag:'OWASP_CRS',\
117
+ tag:'OWASP_CRS/DATA-LEAKAGES-IIS',\
113
118
  tag:'capec/1000/118/116',\
114
119
  tag:'PCI/6.5.6',\
115
- ver:'OWASP_CRS/4.9.0',\
120
+ ver:'OWASP_CRS/4.16.0',\
116
121
  severity:'ERROR',\
117
122
  chain"
118
123
  SecRule RESPONSE_BODY "@rx \bServer Error in.{0,50}?\bApplication\b" \
@@ -122,24 +127,24 @@ SecRule RESPONSE_STATUS "!@rx ^404$" \
122
127
 
123
128
 
124
129
 
125
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:954013,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS"
126
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:954014,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS"
130
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:954013,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS"
131
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:954014,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS"
127
132
  #
128
133
  # -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)
129
134
  #
130
135
 
131
136
 
132
137
 
133
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:954015,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS"
134
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:954016,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS"
138
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:954015,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS"
139
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:954016,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS"
135
140
  #
136
141
  # -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)
137
142
  #
138
143
 
139
144
 
140
145
 
141
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:954017,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS"
142
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:954018,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS"
146
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:954017,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS"
147
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:954018,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS"
143
148
  #
144
149
  # -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)
145
150
  #
package/lib/nginx/includes/security/crs4/rules/RESPONSE-955-WEB-SHELLS.conf CHANGED
@@ -1,7 +1,7 @@
1
1
  # ------------------------------------------------------------------------
2
- # OWASP CRS ver.4.9.0
2
+ # OWASP CRS ver.4.16.0
3
3
  # Copyright (c) 2006-2020 Trustwave and contributors. (not) All rights reserved.
4
- # Copyright (c) 2021-2024 CRS project. All rights reserved.
4
+ # Copyright (c) 2021-2025 CRS project. All rights reserved.
5
5
  #
6
6
  # The OWASP CRS is distributed under
7
7
  # Apache Software License (ASL) version 2
@@ -19,11 +19,12 @@ SecRule RESPONSE_HEADERS:Content-Encoding "@pm gzip compress deflate br zstd" \
19
19
  pass,\
20
20
  nolog,\
21
21
  tag:'OWASP_CRS',\
22
- ver:'OWASP_CRS/4.9.0',\
22
+ tag:'OWASP_CRS/WEB-SHELLS',\
23
+ ver:'OWASP_CRS/4.16.0',\
23
24
  skipAfter:END-RESPONSE-955-WEB-SHELLS"
24
25
 
25
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:955011,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-955-WEB-SHELLS"
26
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:955012,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-955-WEB-SHELLS"
26
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:955011,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-955-WEB-SHELLS"
27
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:955012,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-955-WEB-SHELLS"
27
28
  #
28
29
  # -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)
29
30
  #
@@ -36,15 +37,16 @@ SecRule RESPONSE_BODY "@pmFromFile web-shells-php.data" \
36
37
  block,\
37
38
  capture,\
38
39
  t:none,\
39
- msg:'Web shell detected',\
40
+ msg:'PHP Web shell detected',\
40
41
  logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
41
42
  tag:'language-php',\
42
43
  tag:'platform-multi',\
43
44
  tag:'attack-rce',\
44
45
  tag:'paranoia-level/1',\
45
46
  tag:'OWASP_CRS',\
47
+ tag:'OWASP_CRS/WEB-SHELLS',\
46
48
  tag:'capec/1000/225/122/17/650',\
47
- ver:'OWASP_CRS/4.9.0',\
49
+ ver:'OWASP_CRS/4.16.0',\
48
50
  severity:'CRITICAL',\
49
51
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
50
52
 
@@ -62,8 +64,9 @@ SecRule RESPONSE_BODY "@rx <title>r57 Shell Version [0-9.]+</title>|<title>r57 s
62
64
  tag:'attack-rce',\
63
65
  tag:'paranoia-level/1',\
64
66
  tag:'OWASP_CRS',\
67
+ tag:'OWASP_CRS/WEB-SHELLS',\
65
68
  tag:'capec/1000/225/122/17/650',\
66
- ver:'OWASP_CRS/4.9.0',\
69
+ ver:'OWASP_CRS/4.16.0',\
67
70
  severity:'CRITICAL',\
68
71
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
69
72
 
@@ -81,13 +84,14 @@ SecRule RESPONSE_BODY "@rx ^<html><head><meta http-equiv='Content-Type' content=
81
84
  tag:'attack-rce',\
82
85
  tag:'paranoia-level/1',\
83
86
  tag:'OWASP_CRS',\
87
+ tag:'OWASP_CRS/WEB-SHELLS',\
84
88
  tag:'capec/1000/225/122/17/650',\
85
- ver:'OWASP_CRS/4.9.0',\
89
+ ver:'OWASP_CRS/4.16.0',\
86
90
  severity:'CRITICAL',\
87
91
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
88
92
 
89
93
  # b4tm4n web shell (https://github.com/k4mpr3t/b4tm4n)
90
- SecRule RESPONSE_BODY "@rx B4TM4N SH3LL</title>.*<meta name='author' content='k4mpr3t'/>" \
94
+ SecRule RESPONSE_BODY "@rx B4TM4N SH3LL</title>[^<]*<meta name='author' content='k4mpr3t'/>" \
91
95
  "id:955130,\
92
96
  phase:4,\
93
97
  block,\
@@ -100,13 +104,14 @@ SecRule RESPONSE_BODY "@rx B4TM4N SH3LL</title>.*<meta name='author' content='k4
100
104
  tag:'attack-rce',\
101
105
  tag:'paranoia-level/1',\
102
106
  tag:'OWASP_CRS',\
107
+ tag:'OWASP_CRS/WEB-SHELLS',\
103
108
  tag:'capec/1000/225/122/17/650',\
104
- ver:'OWASP_CRS/4.9.0',\
109
+ ver:'OWASP_CRS/4.16.0',\
105
110
  severity:'CRITICAL',\
106
111
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
107
112
 
108
113
  # Mini Shell web shell
109
- SecRule RESPONSE_BODY "@rx <title>Mini Shell</title>.*Developed By LameHacker" \
114
+ SecRule RESPONSE_BODY "@rx <title>Mini Shell</title>[^D]*Developed By LameHacker" \
110
115
  "id:955140,\
111
116
  phase:4,\
112
117
  block,\
@@ -119,13 +124,14 @@ SecRule RESPONSE_BODY "@rx <title>Mini Shell</title>.*Developed By LameHacker" \
119
124
  tag:'attack-rce',\
120
125
  tag:'paranoia-level/1',\
121
126
  tag:'OWASP_CRS',\
127
+ tag:'OWASP_CRS/WEB-SHELLS',\
122
128
  tag:'capec/1000/225/122/17/650',\
123
- ver:'OWASP_CRS/4.9.0',\
129
+ ver:'OWASP_CRS/4.16.0',\
124
130
  severity:'CRITICAL',\
125
131
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
126
132
 
127
133
  # Ashiyane web shell
128
- SecRule RESPONSE_BODY "@rx <title>\.:: .* ~ Ashiyane V [0-9.]+ ::\.</title>" \
134
+ SecRule RESPONSE_BODY "@rx <title>\.:: [^~]*~ Ashiyane V [0-9.]+ ::\.</title>" \
129
135
  "id:955150,\
130
136
  phase:4,\
131
137
  block,\
@@ -138,8 +144,9 @@ SecRule RESPONSE_BODY "@rx <title>\.:: .* ~ Ashiyane V [0-9.]+ ::\.</title>" \
138
144
  tag:'attack-rce',\
139
145
  tag:'paranoia-level/1',\
140
146
  tag:'OWASP_CRS',\
147
+ tag:'OWASP_CRS/WEB-SHELLS',\
141
148
  tag:'capec/1000/225/122/17/650',\
142
- ver:'OWASP_CRS/4.9.0',\
149
+ ver:'OWASP_CRS/4.16.0',\
143
150
  severity:'CRITICAL',\
144
151
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
145
152
 
@@ -157,8 +164,9 @@ SecRule RESPONSE_BODY "@rx <title>Symlink_Sa [0-9.]+</title>" \
157
164
  tag:'attack-rce',\
158
165
  tag:'paranoia-level/1',\
159
166
  tag:'OWASP_CRS',\
167
+ tag:'OWASP_CRS/WEB-SHELLS',\
160
168
  tag:'capec/1000/225/122/17/650',\
161
- ver:'OWASP_CRS/4.9.0',\
169
+ ver:'OWASP_CRS/4.16.0',\
162
170
  severity:'CRITICAL',\
163
171
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
164
172
 
@@ -176,8 +184,9 @@ SecRule RESPONSE_BODY "@rx <title>CasuS [0-9.]+ by MafiABoY</title>" \
176
184
  tag:'attack-rce',\
177
185
  tag:'paranoia-level/1',\
178
186
  tag:'OWASP_CRS',\
187
+ tag:'OWASP_CRS/WEB-SHELLS',\
179
188
  tag:'capec/1000/225/122/17/650',\
180
- ver:'OWASP_CRS/4.9.0',\
189
+ ver:'OWASP_CRS/4.16.0',\
181
190
  severity:'CRITICAL',\
182
191
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
183
192
 
@@ -195,8 +204,9 @@ SecRule RESPONSE_BODY "@rx ^<html>\r\n<head>\r\n<title>GRP WebShell [0-9.]+ " \
195
204
  tag:'attack-rce',\
196
205
  tag:'paranoia-level/1',\
197
206
  tag:'OWASP_CRS',\
207
+ tag:'OWASP_CRS/WEB-SHELLS',\
198
208
  tag:'capec/1000/225/122/17/650',\
199
- ver:'OWASP_CRS/4.9.0',\
209
+ ver:'OWASP_CRS/4.16.0',\
200
210
  severity:'CRITICAL',\
201
211
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
202
212
 
@@ -214,8 +224,9 @@ SecRule RESPONSE_BODY "@rx <small>NGHshell [0-9.]+ by Cr4sh</body></html>\n$" \
214
224
  tag:'attack-rce',\
215
225
  tag:'paranoia-level/1',\
216
226
  tag:'OWASP_CRS',\
227
+ tag:'OWASP_CRS/WEB-SHELLS',\
217
228
  tag:'capec/1000/225/122/17/650',\
218
- ver:'OWASP_CRS/4.9.0',\
229
+ ver:'OWASP_CRS/4.16.0',\
219
230
  severity:'CRITICAL',\
220
231
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
221
232
 
@@ -233,13 +244,14 @@ SecRule RESPONSE_BODY "@rx <title>SimAttacker - (?:Version|Vrsion) : [0-9.]+ - "
233
244
  tag:'attack-rce',\
234
245
  tag:'paranoia-level/1',\
235
246
  tag:'OWASP_CRS',\
247
+ tag:'OWASP_CRS/WEB-SHELLS',\
236
248
  tag:'capec/1000/225/122/17/650',\
237
- ver:'OWASP_CRS/4.9.0',\
249
+ ver:'OWASP_CRS/4.16.0',\
238
250
  severity:'CRITICAL',\
239
251
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
240
252
 
241
253
  # Unknown web shell
242
- SecRule RESPONSE_BODY "@rx ^<!DOCTYPE html>\n<html>\n<!-- By Artyum .*<title>Web Shell</title>" \
254
+ SecRule RESPONSE_BODY "@rx ^<!DOCTYPE html>\n<html>\n<!-- By Artyum [^<]*<title>Web Shell</title>" \
243
255
  "id:955210,\
244
256
  phase:4,\
245
257
  block,\
@@ -252,8 +264,9 @@ SecRule RESPONSE_BODY "@rx ^<!DOCTYPE html>\n<html>\n<!-- By Artyum .*<title>Web
252
264
  tag:'attack-rce',\
253
265
  tag:'paranoia-level/1',\
254
266
  tag:'OWASP_CRS',\
267
+ tag:'OWASP_CRS/WEB-SHELLS',\
255
268
  tag:'capec/1000/225/122/17/650',\
256
- ver:'OWASP_CRS/4.9.0',\
269
+ ver:'OWASP_CRS/4.16.0',\
257
270
  severity:'CRITICAL',\
258
271
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
259
272
 
@@ -271,8 +284,9 @@ SecRule RESPONSE_BODY "@rx <title>lama's'hell v. [0-9.]+</title>" \
271
284
  tag:'attack-rce',\
272
285
  tag:'paranoia-level/1',\
273
286
  tag:'OWASP_CRS',\
287
+ tag:'OWASP_CRS/WEB-SHELLS',\
274
288
  tag:'capec/1000/225/122/17/650',\
275
- ver:'OWASP_CRS/4.9.0',\
289
+ ver:'OWASP_CRS/4.16.0',\
276
290
  severity:'CRITICAL',\
277
291
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
278
292
 
@@ -290,8 +304,9 @@ SecRule RESPONSE_BODY "@rx ^ *<html>\n[ ]+<head>\n[ ]+<title>lostDC - " \
290
304
  tag:'attack-rce',\
291
305
  tag:'paranoia-level/1',\
292
306
  tag:'OWASP_CRS',\
307
+ tag:'OWASP_CRS/WEB-SHELLS',\
293
308
  tag:'capec/1000/225/122/17/650',\
294
- ver:'OWASP_CRS/4.9.0',\
309
+ ver:'OWASP_CRS/4.16.0',\
295
310
  severity:'CRITICAL',\
296
311
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
297
312
 
@@ -309,8 +324,9 @@ SecRule RESPONSE_BODY "@rx ^<title>PHP Web Shell</title>\r\n<html>\r\n<body>\r\n
309
324
  tag:'attack-rce',\
310
325
  tag:'paranoia-level/1',\
311
326
  tag:'OWASP_CRS',\
327
+ tag:'OWASP_CRS/WEB-SHELLS',\
312
328
  tag:'capec/1000/225/122/17/650',\
313
- ver:'OWASP_CRS/4.9.0',\
329
+ ver:'OWASP_CRS/4.16.0',\
314
330
  severity:'CRITICAL',\
315
331
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
316
332
 
@@ -328,8 +344,9 @@ SecRule RESPONSE_BODY "@rx ^<html>\n<head>\n<div align=\"left\"><font size=\"1\"
328
344
  tag:'attack-rce',\
329
345
  tag:'paranoia-level/1',\
330
346
  tag:'OWASP_CRS',\
347
+ tag:'OWASP_CRS/WEB-SHELLS',\
331
348
  tag:'capec/1000/225/122/17/650',\
332
- ver:'OWASP_CRS/4.9.0',\
349
+ ver:'OWASP_CRS/4.16.0',\
333
350
  severity:'CRITICAL',\
334
351
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
335
352
 
@@ -349,8 +366,9 @@ SecRule RESPONSE_BODY "@rx ^<html>\n<head>\n<title>Ru24PostWebShell " \
349
366
  tag:'attack-rce',\
350
367
  tag:'paranoia-level/1',\
351
368
  tag:'OWASP_CRS',\
369
+ tag:'OWASP_CRS/WEB-SHELLS',\
352
370
  tag:'capec/1000/225/122/17/650',\
353
- ver:'OWASP_CRS/4.9.0',\
371
+ ver:'OWASP_CRS/4.16.0',\
354
372
  severity:'CRITICAL',\
355
373
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
356
374
 
@@ -368,8 +386,9 @@ SecRule RESPONSE_BODY "@rx <title>s72 Shell v[0-9.]+ Codinf by Cr@zy_King</title
368
386
  tag:'attack-rce',\
369
387
  tag:'paranoia-level/1',\
370
388
  tag:'OWASP_CRS',\
389
+ tag:'OWASP_CRS/WEB-SHELLS',\
371
390
  tag:'capec/1000/225/122/17/650',\
372
- ver:'OWASP_CRS/4.9.0',\
391
+ ver:'OWASP_CRS/4.16.0',\
373
392
  severity:'CRITICAL',\
374
393
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
375
394
 
@@ -387,8 +406,9 @@ SecRule RESPONSE_BODY "@rx ^<html>\r\n<head>\r\n<meta http-equiv=\"Content-Type\
387
406
  tag:'attack-rce',\
388
407
  tag:'paranoia-level/1',\
389
408
  tag:'OWASP_CRS',\
409
+ tag:'OWASP_CRS/WEB-SHELLS',\
390
410
  tag:'capec/1000/225/122/17/650',\
391
- ver:'OWASP_CRS/4.9.0',\
411
+ ver:'OWASP_CRS/4.16.0',\
392
412
  severity:'CRITICAL',\
393
413
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
394
414
 
@@ -406,8 +426,9 @@ SecRule RESPONSE_BODY "@rx ^ <html>\n\n<head>\n\n<title>g00nshell v[0-9.]+ " \
406
426
  tag:'attack-rce',\
407
427
  tag:'paranoia-level/1',\
408
428
  tag:'OWASP_CRS',\
429
+ tag:'OWASP_CRS/WEB-SHELLS',\
409
430
  tag:'capec/1000/225/122/17/650',\
410
- ver:'OWASP_CRS/4.9.0',\
431
+ ver:'OWASP_CRS/4.16.0',\
411
432
  severity:'CRITICAL',\
412
433
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
413
434
 
@@ -427,8 +448,9 @@ SecRule RESPONSE_BODY "@contains <title>punkholicshell</title>" \
427
448
  tag:'attack-rce',\
428
449
  tag:'paranoia-level/1',\
429
450
  tag:'OWASP_CRS',\
451
+ tag:'OWASP_CRS/WEB-SHELLS',\
430
452
  tag:'capec/1000/225/122/17/650',\
431
- ver:'OWASP_CRS/4.9.0',\
453
+ ver:'OWASP_CRS/4.16.0',\
432
454
  severity:'CRITICAL',\
433
455
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
434
456
 
@@ -446,8 +468,9 @@ SecRule RESPONSE_BODY "@rx ^<html>\n <head>\n <title>azrail [0-
446
468
  tag:'attack-rce',\
447
469
  tag:'paranoia-level/1',\
448
470
  tag:'OWASP_CRS',\
471
+ tag:'OWASP_CRS/WEB-SHELLS',\
449
472
  tag:'capec/1000/225/122/17/650',\
450
- ver:'OWASP_CRS/4.9.0',\
473
+ ver:'OWASP_CRS/4.16.0',\
451
474
  severity:'CRITICAL',\
452
475
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
453
476
 
@@ -465,13 +488,14 @@ SecRule RESPONSE_BODY "@rx >SmEvK_PaThAn Shell v[0-9]+ coded by <a href=" \
465
488
  tag:'attack-rce',\
466
489
  tag:'paranoia-level/1',\
467
490
  tag:'OWASP_CRS',\
491
+ tag:'OWASP_CRS/WEB-SHELLS',\
468
492
  tag:'capec/1000/225/122/17/650',\
469
- ver:'OWASP_CRS/4.9.0',\
493
+ ver:'OWASP_CRS/4.16.0',\
470
494
  severity:'CRITICAL',\
471
495
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
472
496
 
473
497
  # Shell I web shell
474
- SecRule RESPONSE_BODY "@rx ^<html>\n<title>.*? ~ Shell I</title>\n<head>\n<style>" \
498
+ SecRule RESPONSE_BODY "@rx ^<html>\n<title>[^~]*~ Shell I</title>\n<head>\n<style>" \
475
499
  "id:955330,\
476
500
  phase:4,\
477
501
  block,\
@@ -484,8 +508,9 @@ SecRule RESPONSE_BODY "@rx ^<html>\n<title>.*? ~ Shell I</title>\n<head>\n<style
484
508
  tag:'attack-rce',\
485
509
  tag:'paranoia-level/1',\
486
510
  tag:'OWASP_CRS',\
511
+ tag:'OWASP_CRS/WEB-SHELLS',\
487
512
  tag:'capec/1000/225/122/17/650',\
488
- ver:'OWASP_CRS/4.9.0',\
513
+ ver:'OWASP_CRS/4.16.0',\
489
514
  severity:'CRITICAL',\
490
515
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
491
516
 
@@ -503,15 +528,36 @@ SecRule RESPONSE_BODY "@rx ^ <html><head><title>:: b374k m1n1 [0-9.]+ ::</title>
503
528
  tag:'attack-rce',\
504
529
  tag:'paranoia-level/1',\
505
530
  tag:'OWASP_CRS',\
531
+ tag:'OWASP_CRS/WEB-SHELLS',\
506
532
  tag:'capec/1000/225/122/17/650',\
507
- ver:'OWASP_CRS/4.9.0',\
533
+ ver:'OWASP_CRS/4.16.0',\
534
+ severity:'CRITICAL',\
535
+ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
536
+
537
+ # This rule is intended for ASP web shells.
538
+ SecRule RESPONSE_BODY "@pmFromFile web-shells-asp.data" \
539
+ "id:955400,\
540
+ phase:4,\
541
+ block,\
542
+ capture,\
543
+ t:none,\
544
+ msg:'ASP Web shell detected',\
545
+ logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
546
+ tag:'language-php',\
547
+ tag:'platform-multi',\
548
+ tag:'attack-rce',\
549
+ tag:'paranoia-level/1',\
550
+ tag:'OWASP_CRS',\
551
+ tag:'OWASP_CRS/WEB-SHELLS',\
552
+ tag:'capec/1000/225/122/17/650',\
553
+ ver:'OWASP_CRS/4.16.0',\
508
554
  severity:'CRITICAL',\
509
555
  setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
510
556
 
511
557
 
512
558
 
513
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:955013,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-955-WEB-SHELLS"
514
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:955014,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-955-WEB-SHELLS"
559
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:955013,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-955-WEB-SHELLS"
560
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:955014,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-955-WEB-SHELLS"
515
561
  #
516
562
  # -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)
517
563
  #
@@ -531,21 +577,24 @@ SecRule RESPONSE_BODY "@contains <h1 style=\"margin-bottom: 0\">webadmin.php</h1
531
577
  tag:'attack-rce',\
532
578
  tag:'paranoia-level/2',\
533
579
  tag:'OWASP_CRS',\
580
+ tag:'OWASP_CRS/WEB-SHELLS',\
534
581
  tag:'capec/1000/225/122/17/650',\
535
- ver:'OWASP_CRS/4.9.0',\
582
+ ver:'OWASP_CRS/4.16.0',\
536
583
  severity:'CRITICAL',\
537
584
  setvar:'tx.outbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
538
585
 
539
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:955015,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-955-WEB-SHELLS"
540
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:955016,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-955-WEB-SHELLS"
586
+
587
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:955015,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-955-WEB-SHELLS"
588
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:955016,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-955-WEB-SHELLS"
589
+
541
590
  #
542
591
  # -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)
543
592
  #
544
593
 
545
594
 
546
595
 
547
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:955017,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-955-WEB-SHELLS"
548
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:955018,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-955-WEB-SHELLS"
596
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:955017,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-955-WEB-SHELLS"
597
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:955018,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-955-WEB-SHELLS"
549
598
  #
550
599
  # -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)
551
600
  #