@abtnode/router-provider 1.16.46-beta-20250703-024219-4029ee97 → 1.16.46-beta-20250703-050038-4ba2582f

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (34) hide show
  1. package/lib/nginx/includes/security/crs4/rules/REQUEST-901-INITIALIZATION.conf +42 -40
  2. package/lib/nginx/includes/security/crs4/rules/REQUEST-905-COMMON-EXCEPTIONS.conf +4 -4
  3. package/lib/nginx/includes/security/crs4/rules/REQUEST-911-METHOD-ENFORCEMENT.conf +12 -11
  4. package/lib/nginx/includes/security/crs4/rules/REQUEST-913-SCANNER-DETECTION.conf +12 -11
  5. package/lib/nginx/includes/security/crs4/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf +127 -148
  6. package/lib/nginx/includes/security/crs4/rules/REQUEST-921-PROTOCOL-ATTACK.conf +80 -35
  7. package/lib/nginx/includes/security/crs4/rules/REQUEST-922-MULTIPART-ATTACK.conf +12 -6
  8. package/lib/nginx/includes/security/crs4/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf +22 -17
  9. package/lib/nginx/includes/security/crs4/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf +20 -15
  10. package/lib/nginx/includes/security/crs4/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf +254 -86
  11. package/lib/nginx/includes/security/crs4/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf +172 -65
  12. package/lib/nginx/includes/security/crs4/rules/REQUEST-934-APPLICATION-ATTACK-GENERIC.conf +65 -29
  13. package/lib/nginx/includes/security/crs4/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf +114 -78
  14. package/lib/nginx/includes/security/crs4/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf +182 -120
  15. package/lib/nginx/includes/security/crs4/rules/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.conf +19 -16
  16. package/lib/nginx/includes/security/crs4/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf +48 -34
  17. package/lib/nginx/includes/security/crs4/rules/REQUEST-949-BLOCKING-EVALUATION.conf +30 -30
  18. package/lib/nginx/includes/security/crs4/rules/RESPONSE-950-DATA-LEAKAGES.conf +20 -15
  19. package/lib/nginx/includes/security/crs4/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf +47 -29
  20. package/lib/nginx/includes/security/crs4/rules/RESPONSE-952-DATA-LEAKAGES-JAVA.conf +15 -36
  21. package/lib/nginx/includes/security/crs4/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf +20 -15
  22. package/lib/nginx/includes/security/crs4/rules/RESPONSE-954-DATA-LEAKAGES-IIS.conf +22 -17
  23. package/lib/nginx/includes/security/crs4/rules/RESPONSE-955-WEB-SHELLS.conf +92 -43
  24. package/lib/nginx/includes/security/crs4/rules/RESPONSE-959-BLOCKING-EVALUATION.conf +30 -30
  25. package/lib/nginx/includes/security/crs4/rules/RESPONSE-980-CORRELATION.conf +23 -23
  26. package/lib/nginx/includes/security/crs4/rules/java-classes.data +11 -0
  27. package/lib/nginx/includes/security/crs4/rules/lfi-os-files.data +227 -15
  28. package/lib/nginx/includes/security/crs4/rules/php-function-names-933150.data +0 -7
  29. package/lib/nginx/includes/security/crs4/rules/restricted-files.data +250 -29
  30. package/lib/nginx/includes/security/crs4/rules/restricted-upload.data +200 -26
  31. package/lib/nginx/includes/security/crs4/rules/unix-shell-builtins.data +20 -0
  32. package/lib/nginx/includes/security/crs4/rules/unix-shell.data +39 -18
  33. package/lib/nginx/includes/security/crs4/rules/web-shells-asp.data +23 -0
  34. package/package.json +7 -7
package/lib/nginx/includes/security/crs4/rules/RESPONSE-959-BLOCKING-EVALUATION.conf CHANGED
@@ -1,7 +1,7 @@
1
1
  # ------------------------------------------------------------------------
2
- # OWASP CRS ver.4.9.0
2
+ # OWASP CRS ver.4.16.0
3
3
  # Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
4
- # Copyright (c) 2021-2024 CRS project. All rights reserved.
4
+ # Copyright (c) 2021-2025 CRS project. All rights reserved.
5
5
  #
6
6
  # The OWASP CRS is distributed under
7
7
  # Apache Software License (ASL) version 2
@@ -35,7 +35,7 @@ SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 1" \
35
35
  t:none,\
36
36
  nolog,\
37
37
  tag:'OWASP_CRS',\
38
- ver:'OWASP_CRS/4.9.0',\
38
+ ver:'OWASP_CRS/4.16.0',\
39
39
  setvar:'tx.blocking_outbound_anomaly_score=+%{tx.outbound_anomaly_score_pl1}'"
40
40
 
41
41
  SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 1" \
@@ -45,7 +45,7 @@ SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 1" \
45
45
  t:none,\
46
46
  nolog,\
47
47
  tag:'OWASP_CRS',\
48
- ver:'OWASP_CRS/4.9.0',\
48
+ ver:'OWASP_CRS/4.16.0',\
49
49
  setvar:'tx.detection_outbound_anomaly_score=+%{tx.outbound_anomaly_score_pl1}'"
50
50
 
51
51
  SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 2" \
@@ -55,7 +55,7 @@ SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 2" \
55
55
  t:none,\
56
56
  nolog,\
57
57
  tag:'OWASP_CRS',\
58
- ver:'OWASP_CRS/4.9.0',\
58
+ ver:'OWASP_CRS/4.16.0',\
59
59
  setvar:'tx.blocking_outbound_anomaly_score=+%{tx.outbound_anomaly_score_pl2}'"
60
60
 
61
61
  SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 2" \
@@ -65,7 +65,7 @@ SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 2" \
65
65
  t:none,\
66
66
  nolog,\
67
67
  tag:'OWASP_CRS',\
68
- ver:'OWASP_CRS/4.9.0',\
68
+ ver:'OWASP_CRS/4.16.0',\
69
69
  setvar:'tx.detection_outbound_anomaly_score=+%{tx.outbound_anomaly_score_pl2}'"
70
70
 
71
71
  SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 3" \
@@ -75,7 +75,7 @@ SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 3" \
75
75
  t:none,\
76
76
  nolog,\
77
77
  tag:'OWASP_CRS',\
78
- ver:'OWASP_CRS/4.9.0',\
78
+ ver:'OWASP_CRS/4.16.0',\
79
79
  setvar:'tx.blocking_outbound_anomaly_score=+%{tx.outbound_anomaly_score_pl3}'"
80
80
 
81
81
  SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 3" \
@@ -85,7 +85,7 @@ SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 3" \
85
85
  t:none,\
86
86
  nolog,\
87
87
  tag:'OWASP_CRS',\
88
- ver:'OWASP_CRS/4.9.0',\
88
+ ver:'OWASP_CRS/4.16.0',\
89
89
  setvar:'tx.detection_outbound_anomaly_score=+%{tx.outbound_anomaly_score_pl3}'"
90
90
 
91
91
  SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 4" \
@@ -95,7 +95,7 @@ SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 4" \
95
95
  t:none,\
96
96
  nolog,\
97
97
  tag:'OWASP_CRS',\
98
- ver:'OWASP_CRS/4.9.0',\
98
+ ver:'OWASP_CRS/4.16.0',\
99
99
  setvar:'tx.blocking_outbound_anomaly_score=+%{tx.outbound_anomaly_score_pl4}'"
100
100
 
101
101
  SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 4" \
@@ -105,7 +105,7 @@ SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 4" \
105
105
  t:none,\
106
106
  nolog,\
107
107
  tag:'OWASP_CRS',\
108
- ver:'OWASP_CRS/4.9.0',\
108
+ ver:'OWASP_CRS/4.16.0',\
109
109
  setvar:'tx.detection_outbound_anomaly_score=+%{tx.outbound_anomaly_score_pl4}'"
110
110
 
111
111
  # at start of phase 4, we reset the aggregate scores to 0 to prevent duplicate counting of per-PL scores
@@ -117,7 +117,7 @@ SecAction \
117
117
  t:none,\
118
118
  nolog,\
119
119
  tag:'OWASP_CRS',\
120
- ver:'OWASP_CRS/4.9.0',\
120
+ ver:'OWASP_CRS/4.16.0',\
121
121
  setvar:'tx.blocking_outbound_anomaly_score=0'"
122
122
 
123
123
  SecAction \
@@ -127,7 +127,7 @@ SecAction \
127
127
  t:none,\
128
128
  nolog,\
129
129
  tag:'OWASP_CRS',\
130
- ver:'OWASP_CRS/4.9.0',\
130
+ ver:'OWASP_CRS/4.16.0',\
131
131
  setvar:'tx.detection_outbound_anomaly_score=0'"
132
132
 
133
133
  SecMarker "EARLY_BLOCKING_ANOMALY_SCORING"
@@ -141,7 +141,7 @@ SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 1" \
141
141
  t:none,\
142
142
  nolog,\
143
143
  tag:'OWASP_CRS',\
144
- ver:'OWASP_CRS/4.9.0',\
144
+ ver:'OWASP_CRS/4.16.0',\
145
145
  setvar:'tx.blocking_outbound_anomaly_score=+%{tx.outbound_anomaly_score_pl1}'"
146
146
 
147
147
  SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 1" \
@@ -151,7 +151,7 @@ SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 1" \
151
151
  t:none,\
152
152
  nolog,\
153
153
  tag:'OWASP_CRS',\
154
- ver:'OWASP_CRS/4.9.0',\
154
+ ver:'OWASP_CRS/4.16.0',\
155
155
  setvar:'tx.detection_outbound_anomaly_score=+%{tx.outbound_anomaly_score_pl1}'"
156
156
 
157
157
  SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 2" \
@@ -161,7 +161,7 @@ SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 2" \
161
161
  t:none,\
162
162
  nolog,\
163
163
  tag:'OWASP_CRS',\
164
- ver:'OWASP_CRS/4.9.0',\
164
+ ver:'OWASP_CRS/4.16.0',\
165
165
  setvar:'tx.blocking_outbound_anomaly_score=+%{tx.outbound_anomaly_score_pl2}'"
166
166
 
167
167
  SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 2" \
@@ -171,7 +171,7 @@ SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 2" \
171
171
  t:none,\
172
172
  nolog,\
173
173
  tag:'OWASP_CRS',\
174
- ver:'OWASP_CRS/4.9.0',\
174
+ ver:'OWASP_CRS/4.16.0',\
175
175
  setvar:'tx.detection_outbound_anomaly_score=+%{tx.outbound_anomaly_score_pl2}'"
176
176
 
177
177
  SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 3" \
@@ -181,7 +181,7 @@ SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 3" \
181
181
  t:none,\
182
182
  nolog,\
183
183
  tag:'OWASP_CRS',\
184
- ver:'OWASP_CRS/4.9.0',\
184
+ ver:'OWASP_CRS/4.16.0',\
185
185
  setvar:'tx.blocking_outbound_anomaly_score=+%{tx.outbound_anomaly_score_pl3}'"
186
186
 
187
187
  SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 3" \
@@ -191,7 +191,7 @@ SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 3" \
191
191
  t:none,\
192
192
  nolog,\
193
193
  tag:'OWASP_CRS',\
194
- ver:'OWASP_CRS/4.9.0',\
194
+ ver:'OWASP_CRS/4.16.0',\
195
195
  setvar:'tx.detection_outbound_anomaly_score=+%{tx.outbound_anomaly_score_pl3}'"
196
196
 
197
197
  SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 4" \
@@ -201,7 +201,7 @@ SecRule TX:BLOCKING_PARANOIA_LEVEL "@ge 4" \
201
201
  t:none,\
202
202
  nolog,\
203
203
  tag:'OWASP_CRS',\
204
- ver:'OWASP_CRS/4.9.0',\
204
+ ver:'OWASP_CRS/4.16.0',\
205
205
  setvar:'tx.blocking_outbound_anomaly_score=+%{tx.outbound_anomaly_score_pl4}'"
206
206
 
207
207
  SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 4" \
@@ -211,7 +211,7 @@ SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 4" \
211
211
  t:none,\
212
212
  nolog,\
213
213
  tag:'OWASP_CRS',\
214
- ver:'OWASP_CRS/4.9.0',\
214
+ ver:'OWASP_CRS/4.16.0',\
215
215
  setvar:'tx.detection_outbound_anomaly_score=+%{tx.outbound_anomaly_score_pl4}'"
216
216
 
217
217
  #
@@ -227,7 +227,7 @@ SecRule TX:BLOCKING_OUTBOUND_ANOMALY_SCORE "@ge %{tx.outbound_anomaly_score_thre
227
227
  msg:'Outbound Anomaly Score Exceeded in phase 3 (Total Score: %{tx.blocking_outbound_anomaly_score})',\
228
228
  tag:'anomaly-evaluation',\
229
229
  tag:'OWASP_CRS',\
230
- ver:'OWASP_CRS/4.9.0',\
230
+ ver:'OWASP_CRS/4.16.0',\
231
231
  chain"
232
232
  SecRule TX:EARLY_BLOCKING "@eq 1"
233
233
 
@@ -240,34 +240,34 @@ SecRule TX:BLOCKING_OUTBOUND_ANOMALY_SCORE "@ge %{tx.outbound_anomaly_score_thre
240
240
  msg:'Outbound Anomaly Score Exceeded (Total Score: %{tx.blocking_outbound_anomaly_score})',\
241
241
  tag:'anomaly-evaluation',\
242
242
  tag:'OWASP_CRS',\
243
- ver:'OWASP_CRS/4.9.0'"
243
+ ver:'OWASP_CRS/4.16.0'"
244
244
 
245
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:959011,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-959-BLOCKING-EVALUATION"
246
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:959012,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-959-BLOCKING-EVALUATION"
245
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:959011,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-959-BLOCKING-EVALUATION"
246
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:959012,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-959-BLOCKING-EVALUATION"
247
247
  #
248
248
  # -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)
249
249
  #
250
250
 
251
251
 
252
252
 
253
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:959013,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-959-BLOCKING-EVALUATION"
254
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:959014,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-959-BLOCKING-EVALUATION"
253
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:959013,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-959-BLOCKING-EVALUATION"
254
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:959014,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-959-BLOCKING-EVALUATION"
255
255
  #
256
256
  # -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)
257
257
  #
258
258
 
259
259
 
260
260
 
261
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:959015,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-959-BLOCKING-EVALUATION"
262
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:959016,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-959-BLOCKING-EVALUATION"
261
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:959015,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-959-BLOCKING-EVALUATION"
262
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:959016,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-959-BLOCKING-EVALUATION"
263
263
  #
264
264
  # -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)
265
265
  #
266
266
 
267
267
 
268
268
 
269
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:959017,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-959-BLOCKING-EVALUATION"
270
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:959018,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-959-BLOCKING-EVALUATION"
269
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:959017,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-959-BLOCKING-EVALUATION"
270
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:959018,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-959-BLOCKING-EVALUATION"
271
271
  #
272
272
  # -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)
273
273
  #
package/lib/nginx/includes/security/crs4/rules/RESPONSE-980-CORRELATION.conf CHANGED
@@ -1,7 +1,7 @@
1
1
  # ------------------------------------------------------------------------
2
- # OWASP CRS ver.4.9.0
2
+ # OWASP CRS ver.4.16.0
3
3
  # Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
4
- # Copyright (c) 2021-2024 CRS project. All rights reserved.
4
+ # Copyright (c) 2021-2025 CRS project. All rights reserved.
5
5
  #
6
6
  # The OWASP CRS is distributed under
7
7
  # Apache Software License (ASL) version 2
@@ -28,7 +28,7 @@ SecAction \
28
28
  nolog,\
29
29
  noauditlog,\
30
30
  tag:'OWASP_CRS',\
31
- ver:'OWASP_CRS/4.9.0',\
31
+ ver:'OWASP_CRS/4.16.0',\
32
32
  setvar:'tx.blocking_anomaly_score=%{tx.blocking_inbound_anomaly_score}',\
33
33
  setvar:'tx.blocking_anomaly_score=+%{tx.blocking_outbound_anomaly_score}',\
34
34
  setvar:'tx.detection_anomaly_score=%{tx.detection_inbound_anomaly_score}',\
@@ -41,33 +41,33 @@ SecAction \
41
41
  #
42
42
 
43
43
  # -= Reporting Level 0 =- (Skip over reporting when tx.reporting_level is 0)
44
- SecRule TX:REPORTING_LEVEL "@eq 0" "id:980041,phase:5,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REPORTING"
44
+ SecRule TX:REPORTING_LEVEL "@eq 0" "id:980041,phase:5,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REPORTING"
45
45
 
46
46
  # -= Reporting Level 5 =- (Jump to reporting rule immediately when tx.reporting_level is 5 or greater)
47
- SecRule TX:REPORTING_LEVEL "@ge 5" "id:980042,phase:5,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:LOG-REPORTING"
47
+ SecRule TX:REPORTING_LEVEL "@ge 5" "id:980042,phase:5,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:LOG-REPORTING"
48
48
 
49
49
  # -= Zero detection score =- (Skip over reporting when sum of inbound and outbound detection score is equal to 0)
50
- SecRule TX:DETECTION_ANOMALY_SCORE "@eq 0" "id:980043,phase:5,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REPORTING"
50
+ SecRule TX:DETECTION_ANOMALY_SCORE "@eq 0" "id:980043,phase:5,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REPORTING"
51
51
 
52
52
  # -= Blocking score exceeds threshold =- (Jump to reporting rule immediately if a blocking score exceeds a threshold)
53
- SecRule TX:BLOCKING_INBOUND_ANOMALY_SCORE "@ge %{tx.inbound_anomaly_score_threshold}" "id:980044,phase:5,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:LOG-REPORTING"
54
- SecRule TX:BLOCKING_OUTBOUND_ANOMALY_SCORE "@ge %{tx.outbound_anomaly_score_threshold}" "id:980045,phase:5,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:LOG-REPORTING"
53
+ SecRule TX:BLOCKING_INBOUND_ANOMALY_SCORE "@ge %{tx.inbound_anomaly_score_threshold}" "id:980044,phase:5,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:LOG-REPORTING"
54
+ SecRule TX:BLOCKING_OUTBOUND_ANOMALY_SCORE "@ge %{tx.outbound_anomaly_score_threshold}" "id:980045,phase:5,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:LOG-REPORTING"
55
55
 
56
56
  # -= Reporting Level 2 =- (Skip over reporting when tx.reporting_level is less than 2)
57
- SecRule TX:REPORTING_LEVEL "@lt 2" "id:980046,phase:5,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REPORTING"
57
+ SecRule TX:REPORTING_LEVEL "@lt 2" "id:980046,phase:5,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REPORTING"
58
58
 
59
59
  # -= Detection score exceeds threshold =- (Jump to reporting rule immediately if a detection score exceeds a threshold)
60
- SecRule TX:DETECTION_INBOUND_ANOMALY_SCORE "@ge %{tx.inbound_anomaly_score_threshold}" "id:980047,phase:5,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:LOG-REPORTING"
61
- SecRule TX:DETECTION_OUTBOUND_ANOMALY_SCORE "@ge %{tx.outbound_anomaly_score_threshold}" "id:980048,phase:5,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:LOG-REPORTING"
60
+ SecRule TX:DETECTION_INBOUND_ANOMALY_SCORE "@ge %{tx.inbound_anomaly_score_threshold}" "id:980047,phase:5,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:LOG-REPORTING"
61
+ SecRule TX:DETECTION_OUTBOUND_ANOMALY_SCORE "@ge %{tx.outbound_anomaly_score_threshold}" "id:980048,phase:5,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:LOG-REPORTING"
62
62
 
63
63
  # -= Reporting Level 3 =- (Skip over reporting when tx.reporting_level is less than 3)
64
- SecRule TX:REPORTING_LEVEL "@lt 3" "id:980049,phase:5,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REPORTING"
64
+ SecRule TX:REPORTING_LEVEL "@lt 3" "id:980049,phase:5,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REPORTING"
65
65
 
66
66
  # -= Blocking score greater than zero =- (Jump to reporting rule immediately when sum of inbound and outbound blocking score is greater than zero)
67
- SecRule TX:BLOCKING_ANOMALY_SCORE "@gt 0" "id:980050,phase:5,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:LOG-REPORTING"
67
+ SecRule TX:BLOCKING_ANOMALY_SCORE "@gt 0" "id:980050,phase:5,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:LOG-REPORTING"
68
68
 
69
69
  # -= Reporting Level 4 =- (Skip over reporting when tx.reporting_level is less than 4)
70
- SecRule TX:REPORTING_LEVEL "@lt 4" "id:980051,phase:5,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REPORTING"
70
+ SecRule TX:REPORTING_LEVEL "@lt 4" "id:980051,phase:5,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REPORTING"
71
71
 
72
72
  # At this point, the reporting level is 4 and there's a non-zero detection
73
73
  # score (already established by rule 980043) so fall through to the reporting
@@ -95,37 +95,37 @@ SecAction \
95
95
  (SQLI=%{tx.sql_injection_score}, XSS=%{tx.xss_score}, RFI=%{tx.rfi_score}, LFI=%{tx.lfi_score}, RCE=%{tx.rce_score}, PHPI=%{tx.php_injection_score}, HTTP=%{tx.http_violation_score}, SESS=%{tx.session_fixation_score}, COMBINED_SCORE=%{tx.anomaly_score})',\
96
96
  tag:'reporting',\
97
97
  tag:'OWASP_CRS',\
98
- ver:'OWASP_CRS/4.9.0'"
98
+ ver:'OWASP_CRS/4.16.0'"
99
99
 
100
100
  SecMarker "END-REPORTING"
101
101
 
102
102
 
103
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:980011,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-980-CORRELATION"
104
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:980012,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-980-CORRELATION"
103
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:980011,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-980-CORRELATION"
104
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:980012,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-980-CORRELATION"
105
105
  #
106
106
  # -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)
107
107
  #
108
108
 
109
109
 
110
110
 
111
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:980013,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-980-CORRELATION"
112
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:980014,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-980-CORRELATION"
111
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:980013,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-980-CORRELATION"
112
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:980014,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-980-CORRELATION"
113
113
  #
114
114
  # -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)
115
115
  #
116
116
 
117
117
 
118
118
 
119
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:980015,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-980-CORRELATION"
120
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:980016,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-980-CORRELATION"
119
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:980015,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-980-CORRELATION"
120
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:980016,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-980-CORRELATION"
121
121
  #
122
122
  # -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)
123
123
  #
124
124
 
125
125
 
126
126
 
127
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:980017,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-980-CORRELATION"
128
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:980018,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-980-CORRELATION"
127
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:980017,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-980-CORRELATION"
128
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:980018,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-RESPONSE-980-CORRELATION"
129
129
  #
130
130
  # -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)
131
131
  #
package/lib/nginx/includes/security/crs4/rules/java-classes.data CHANGED
@@ -34,6 +34,7 @@ java.io.InputStream
34
34
  java.io.InputStreamReader
35
35
  java.io.IOException
36
36
  java.io.LineNumberReader
37
+ java.io.ObjectInputStream
37
38
  java.io.ObjectOutputStream
38
39
  java.io.OutputStream
39
40
  java.io.PipedOutputStream
@@ -53,12 +54,22 @@ java.lang.Runtime
53
54
  java.lang.String
54
55
  java.lang.StringBuilder
55
56
  java.lang.System
57
+ java.net.HttpURLConnection
58
+ java.net.ServerSocket
56
59
  java.net.Socket
60
+ java.net.URL
57
61
  javassist
62
+ javax.naming.InitialContext
58
63
  javax.script.ScriptEngineManager
64
+ javax.xml.parsers
65
+ javax.xml.stream
59
66
  org.apache.commons
60
67
  org.apache.struts
61
68
  org.apache.struts2
69
+ org.dom4j.io.SAXReader
70
+ org.jdom2.input.SAXBuilder
62
71
  org.omg.CORBA
72
+ org.xml.sax
63
73
  java.beans.XMLDecode
74
+ java.nio.file
64
75
  sun.reflect