@abtnode/router-provider 1.16.46-beta-20250703-024219-4029ee97 → 1.16.46-beta-20250703-050038-4ba2582f

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (34) hide show
  1. package/lib/nginx/includes/security/crs4/rules/REQUEST-901-INITIALIZATION.conf +42 -40
  2. package/lib/nginx/includes/security/crs4/rules/REQUEST-905-COMMON-EXCEPTIONS.conf +4 -4
  3. package/lib/nginx/includes/security/crs4/rules/REQUEST-911-METHOD-ENFORCEMENT.conf +12 -11
  4. package/lib/nginx/includes/security/crs4/rules/REQUEST-913-SCANNER-DETECTION.conf +12 -11
  5. package/lib/nginx/includes/security/crs4/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf +127 -148
  6. package/lib/nginx/includes/security/crs4/rules/REQUEST-921-PROTOCOL-ATTACK.conf +80 -35
  7. package/lib/nginx/includes/security/crs4/rules/REQUEST-922-MULTIPART-ATTACK.conf +12 -6
  8. package/lib/nginx/includes/security/crs4/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf +22 -17
  9. package/lib/nginx/includes/security/crs4/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf +20 -15
  10. package/lib/nginx/includes/security/crs4/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf +254 -86
  11. package/lib/nginx/includes/security/crs4/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf +172 -65
  12. package/lib/nginx/includes/security/crs4/rules/REQUEST-934-APPLICATION-ATTACK-GENERIC.conf +65 -29
  13. package/lib/nginx/includes/security/crs4/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf +114 -78
  14. package/lib/nginx/includes/security/crs4/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf +182 -120
  15. package/lib/nginx/includes/security/crs4/rules/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.conf +19 -16
  16. package/lib/nginx/includes/security/crs4/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf +48 -34
  17. package/lib/nginx/includes/security/crs4/rules/REQUEST-949-BLOCKING-EVALUATION.conf +30 -30
  18. package/lib/nginx/includes/security/crs4/rules/RESPONSE-950-DATA-LEAKAGES.conf +20 -15
  19. package/lib/nginx/includes/security/crs4/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf +47 -29
  20. package/lib/nginx/includes/security/crs4/rules/RESPONSE-952-DATA-LEAKAGES-JAVA.conf +15 -36
  21. package/lib/nginx/includes/security/crs4/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf +20 -15
  22. package/lib/nginx/includes/security/crs4/rules/RESPONSE-954-DATA-LEAKAGES-IIS.conf +22 -17
  23. package/lib/nginx/includes/security/crs4/rules/RESPONSE-955-WEB-SHELLS.conf +92 -43
  24. package/lib/nginx/includes/security/crs4/rules/RESPONSE-959-BLOCKING-EVALUATION.conf +30 -30
  25. package/lib/nginx/includes/security/crs4/rules/RESPONSE-980-CORRELATION.conf +23 -23
  26. package/lib/nginx/includes/security/crs4/rules/java-classes.data +11 -0
  27. package/lib/nginx/includes/security/crs4/rules/lfi-os-files.data +227 -15
  28. package/lib/nginx/includes/security/crs4/rules/php-function-names-933150.data +0 -7
  29. package/lib/nginx/includes/security/crs4/rules/restricted-files.data +250 -29
  30. package/lib/nginx/includes/security/crs4/rules/restricted-upload.data +200 -26
  31. package/lib/nginx/includes/security/crs4/rules/unix-shell-builtins.data +20 -0
  32. package/lib/nginx/includes/security/crs4/rules/unix-shell.data +39 -18
  33. package/lib/nginx/includes/security/crs4/rules/web-shells-asp.data +23 -0
  34. package/package.json +7 -7
package/lib/nginx/includes/security/crs4/rules/REQUEST-921-PROTOCOL-ATTACK.conf CHANGED
@@ -1,7 +1,7 @@
1
1
  # ------------------------------------------------------------------------
2
- # OWASP CRS ver.4.9.0
2
+ # OWASP CRS ver.4.16.0
3
3
  # Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
4
- # Copyright (c) 2021-2024 CRS project. All rights reserved.
4
+ # Copyright (c) 2021-2025 CRS project. All rights reserved.
5
5
  #
6
6
  # The OWASP CRS is distributed under
7
7
  # Apache Software License (ASL) version 2
@@ -14,8 +14,8 @@
14
14
 
15
15
 
16
16
 
17
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:921011,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-921-PROTOCOL-ATTACK"
18
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:921012,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-921-PROTOCOL-ATTACK"
17
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:921011,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-921-PROTOCOL-ATTACK"
18
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:921012,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-921-PROTOCOL-ATTACK"
19
19
  #
20
20
  # -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)
21
21
  #
@@ -45,8 +45,9 @@ SecRule ARGS_NAMES|ARGS|REQUEST_BODY|XML:/* "@rx (?:get|post|head|options|connec
45
45
  tag:'attack-protocol',\
46
46
  tag:'paranoia-level/1',\
47
47
  tag:'OWASP_CRS',\
48
+ tag:'OWASP_CRS/PROTOCOL-ATTACK',\
48
49
  tag:'capec/1000/210/272/220/33',\
49
- ver:'OWASP_CRS/4.9.0',\
50
+ ver:'OWASP_CRS/4.16.0',\
50
51
  severity:'CRITICAL',\
51
52
  setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\
52
53
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
@@ -63,7 +64,7 @@ SecRule ARGS_NAMES|ARGS|REQUEST_BODY|XML:/* "@rx (?:get|post|head|options|connec
63
64
  # [ References ]
64
65
  # http://projects.webappsec.org/HTTP-Response-Splitting
65
66
  #
66
- SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx [\r\n]\W*?(?:content-(?:type|length)|set-cookie|location):\s*\w" \
67
+ SecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx [\r\n]\W*?(?:content-(?:type|length)|set-cookie|location):\s*\w" \
67
68
  "id:921120,\
68
69
  phase:2,\
69
70
  block,\
@@ -77,14 +78,15 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME
77
78
  tag:'attack-protocol',\
78
79
  tag:'paranoia-level/1',\
79
80
  tag:'OWASP_CRS',\
81
+ tag:'OWASP_CRS/PROTOCOL-ATTACK',\
80
82
  tag:'capec/1000/210/272/220/34',\
81
- ver:'OWASP_CRS/4.9.0',\
83
+ ver:'OWASP_CRS/4.16.0',\
82
84
  severity:'CRITICAL',\
83
85
  setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\
84
86
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
85
87
 
86
88
 
87
- SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?:\bhttp/\d|<(?:html|meta)\b)" \
89
+ SecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?:\bhttp/\d|<(?:html|meta)\b)" \
88
90
  "id:921130,\
89
91
  phase:2,\
90
92
  block,\
@@ -98,8 +100,9 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME
98
100
  tag:'attack-protocol',\
99
101
  tag:'paranoia-level/1',\
100
102
  tag:'OWASP_CRS',\
103
+ tag:'OWASP_CRS/PROTOCOL-ATTACK',\
101
104
  tag:'capec/1000/210/272/220/34',\
102
- ver:'OWASP_CRS/4.9.0',\
105
+ ver:'OWASP_CRS/4.16.0',\
103
106
  severity:'CRITICAL',\
104
107
  setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\
105
108
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
@@ -123,7 +126,7 @@ SecRule REQUEST_HEADERS_NAMES|REQUEST_HEADERS "@rx [\n\r]" \
123
126
  phase:1,\
124
127
  block,\
125
128
  capture,\
126
- t:none,t:htmlEntityDecode,\
129
+ t:none,t:urlDecodeUni,\
127
130
  msg:'HTTP Header Injection Attack via headers',\
128
131
  logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
129
132
  tag:'application-multi',\
@@ -132,8 +135,9 @@ SecRule REQUEST_HEADERS_NAMES|REQUEST_HEADERS "@rx [\n\r]" \
132
135
  tag:'attack-protocol',\
133
136
  tag:'paranoia-level/1',\
134
137
  tag:'OWASP_CRS',\
138
+ tag:'OWASP_CRS/PROTOCOL-ATTACK',\
135
139
  tag:'capec/1000/210/272/220/273',\
136
- ver:'OWASP_CRS/4.9.0',\
140
+ ver:'OWASP_CRS/4.16.0',\
137
141
  severity:'CRITICAL',\
138
142
  setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\
139
143
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
@@ -151,7 +155,7 @@ SecRule ARGS_NAMES "@rx [\n\r]" \
151
155
  phase:2,\
152
156
  block,\
153
157
  capture,\
154
- t:none,t:htmlEntityDecode,\
158
+ t:none,\
155
159
  msg:'HTTP Header Injection Attack via payload (CR/LF detected)',\
156
160
  logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
157
161
  tag:'application-multi',\
@@ -160,8 +164,9 @@ SecRule ARGS_NAMES "@rx [\n\r]" \
160
164
  tag:'attack-protocol',\
161
165
  tag:'paranoia-level/1',\
162
166
  tag:'OWASP_CRS',\
167
+ tag:'OWASP_CRS/PROTOCOL-ATTACK',\
163
168
  tag:'capec/1000/210/272/220/33',\
164
- ver:'OWASP_CRS/4.9.0',\
169
+ ver:'OWASP_CRS/4.16.0',\
165
170
  severity:'CRITICAL',\
166
171
  setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\
167
172
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
@@ -172,7 +177,7 @@ SecRule ARGS_GET_NAMES|ARGS_GET "@rx [\n\r]+(?:\s|location|refresh|(?:set-)?cook
172
177
  phase:1,\
173
178
  block,\
174
179
  capture,\
175
- t:none,t:htmlEntityDecode,t:lowercase,\
180
+ t:none,t:lowercase,\
176
181
  msg:'HTTP Header Injection Attack via payload (CR/LF and header-name detected)',\
177
182
  logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
178
183
  tag:'application-multi',\
@@ -181,8 +186,9 @@ SecRule ARGS_GET_NAMES|ARGS_GET "@rx [\n\r]+(?:\s|location|refresh|(?:set-)?cook
181
186
  tag:'attack-protocol',\
182
187
  tag:'paranoia-level/1',\
183
188
  tag:'OWASP_CRS',\
189
+ tag:'OWASP_CRS/PROTOCOL-ATTACK',\
184
190
  tag:'capec/1000/210/272/220/33',\
185
- ver:'OWASP_CRS/4.9.0',\
191
+ ver:'OWASP_CRS/4.16.0',\
186
192
  severity:'CRITICAL',\
187
193
  setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\
188
194
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
@@ -207,8 +213,9 @@ SecRule REQUEST_FILENAME "@rx [\n\r]" \
207
213
  tag:'attack-protocol',\
208
214
  tag:'paranoia-level/1',\
209
215
  tag:'OWASP_CRS',\
216
+ tag:'OWASP_CRS/PROTOCOL-ATTACK',\
210
217
  tag:'capec/1000/210/272/220/34',\
211
- ver:'OWASP_CRS/4.9.0',\
218
+ ver:'OWASP_CRS/4.16.0',\
212
219
  severity:'CRITICAL',\
213
220
  setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\
214
221
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
@@ -227,7 +234,7 @@ SecRule REQUEST_FILENAME "@rx [\n\r]" \
227
234
  # * https://www.sonarsource.com/blog/joomla-takeover-in-20-seconds-with-ldap-injection-cve-2017-14596/
228
235
  # * https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/276#issue-126581660
229
236
 
230
- SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx ^[^:\(\)\&\|\!\<\>\~]*\)\s*(?:\((?:[^,\(\)\=\&\|\!\<\>\~]+[><~]?=|\s*[&!|]\s*(?:\)|\()?\s*)|\)\s*\(\s*[\&\|\!]\s*|[&!|]\s*\([^\(\)\=\&\|\!\<\>\~]+[><~]?=[^:\(\)\&\|\!\<\>\~]*)" \
237
+ SecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx ^[^:\(\)\&\|\!\<\>\~]*\)\s*(?:\((?:[^,\(\)\=\&\|\!\<\>\~]+[><~]?=|\s*[&!|]\s*(?:\)|\()?\s*)|\)\s*\(\s*[\&\|\!]\s*|[&!|]\s*\([^\(\)\=\&\|\!\<\>\~]+[><~]?=[^:\(\)\&\|\!\<\>\~]*)" \
231
238
  "id:921200,\
232
239
  phase:2,\
233
240
  block,\
@@ -240,8 +247,9 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME
240
247
  tag:'platform-multi',\
241
248
  tag:'paranoia-level/1',\
242
249
  tag:'OWASP_CRS',\
250
+ tag:'OWASP_CRS/PROTOCOL-ATTACK',\
243
251
  tag:'capec/1000/152/248/136',\
244
- ver:'OWASP_CRS/4.9.0',\
252
+ ver:'OWASP_CRS/4.16.0',\
245
253
  severity:'CRITICAL',\
246
254
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
247
255
 
@@ -272,9 +280,10 @@ SecRule REQUEST_HEADERS:Content-Type "@rx ^[^\s\x0b,;]+[\s\x0b,;].*?(?:applicati
272
280
  tag:'attack-protocol',\
273
281
  tag:'paranoia-level/1',\
274
282
  tag:'OWASP_CRS',\
283
+ tag:'OWASP_CRS/PROTOCOL-ATTACK',\
275
284
  tag:'capec/1000/255/153',\
276
285
  tag:'PCI/12.1',\
277
- ver:'OWASP_CRS/4.9.0',\
286
+ ver:'OWASP_CRS/4.16.0',\
278
287
  severity:'CRITICAL',\
279
288
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
280
289
 
@@ -285,7 +294,7 @@ SecRule REQUEST_HEADERS:Content-Type "@rx ^[^\s\x0b,;]+[\s\x0b,;].*?(?:applicati
285
294
  # This issue affects Apache HTTP Server 2.4.48 and earlier.
286
295
  # GET /?unix:AAAAAAAAAAAAA|http://coreruleset.org/
287
296
  #
288
- SecRule REQUEST_URI "@rx unix:[^|]*\|" \
297
+ SecRule REQUEST_URI_RAW "@rx unix:[^|]*\|" \
289
298
  "id:921240,\
290
299
  phase:1,\
291
300
  block,\
@@ -299,14 +308,43 @@ SecRule REQUEST_URI "@rx unix:[^|]*\|" \
299
308
  tag:'attack-protocol',\
300
309
  tag:'paranoia-level/1',\
301
310
  tag:'OWASP_CRS',\
311
+ tag:'OWASP_CRS/PROTOCOL-ATTACK',\
312
+ tag:'capec/1000/210/272/220/33',\
313
+ ver:'OWASP_CRS/4.16.0',\
314
+ severity:'CRITICAL',\
315
+ setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
316
+
317
+
318
+ # Detection for old V1 cookie format from RFC 2109.
319
+ #
320
+ # This has been abused by the cookie sandwich technique, in diverse issues affecting Apache Tomcat, Python, and maybe others.
321
+ # RFC 6265 deprecated and replaced RFCs 2109 and 2965.
322
+ # It completely removed "$Version", meaning user agents and servers no longer use this attribute.
323
+ # See:
324
+ # - https://portswigger.net/research/stealing-httponly-cookies-with-the-cookie-sandwich-technique
325
+ # - https://github.com/owasp-modsecurity/ModSecurity/wiki/Reference-Manual-%28v2.x%29#seccookieformat
326
+ SecRule REQUEST_COOKIES:/\x22?\x24Version/ "@streq 1" \
327
+ "id:921250,\
328
+ phase:1,\
329
+ block,\
330
+ capture,\
331
+ t:none,t:lowercase,\
332
+ msg:'Old Cookies V1 usage attempt detected',\
333
+ logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
334
+ tag:'application-multi',\
335
+ tag:'language-multi',\
336
+ tag:'attack-protocol',\
337
+ tag:'paranoia-level/1',\
338
+ tag:'OWASP_CRS',\
339
+ tag:'OWASP_CRS/PROTOCOL-ATTACK',\
302
340
  tag:'capec/1000/210/272/220/33',\
303
- ver:'OWASP_CRS/4.9.0',\
341
+ ver:'OWASP_CRS/4.16.0',\
304
342
  severity:'CRITICAL',\
305
343
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
306
344
 
307
345
 
308
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:921013,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-921-PROTOCOL-ATTACK"
309
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:921014,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-921-PROTOCOL-ATTACK"
346
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:921013,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-921-PROTOCOL-ATTACK"
347
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:921014,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-921-PROTOCOL-ATTACK"
310
348
  #
311
349
  # -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)
312
350
  #
@@ -323,7 +361,7 @@ SecRule ARGS_GET "@rx [\n\r]" \
323
361
  phase:1,\
324
362
  block,\
325
363
  capture,\
326
- t:none,t:htmlEntityDecode,\
364
+ t:none,\
327
365
  msg:'HTTP Header Injection Attack via payload (CR/LF detected)',\
328
366
  logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
329
367
  tag:'application-multi',\
@@ -332,8 +370,9 @@ SecRule ARGS_GET "@rx [\n\r]" \
332
370
  tag:'attack-protocol',\
333
371
  tag:'paranoia-level/2',\
334
372
  tag:'OWASP_CRS',\
373
+ tag:'OWASP_CRS/PROTOCOL-ATTACK',\
335
374
  tag:'capec/1000/210/272/220/33',\
336
- ver:'OWASP_CRS/4.9.0',\
375
+ ver:'OWASP_CRS/4.16.0',\
337
376
  severity:'CRITICAL',\
338
377
  setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\
339
378
  setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
@@ -367,15 +406,16 @@ SecRule REQUEST_HEADERS:Content-Type "@rx ^[^\s\x0b,;]+[\s\x0b,;].*?\b(?:((?:tex
367
406
  tag:'attack-protocol',\
368
407
  tag:'paranoia-level/2',\
369
408
  tag:'OWASP_CRS',\
409
+ tag:'OWASP_CRS/PROTOCOL-ATTACK',\
370
410
  tag:'capec/1000/255/153',\
371
411
  tag:'PCI/12.1',\
372
- ver:'OWASP_CRS/4.9.0',\
412
+ ver:'OWASP_CRS/4.16.0',\
373
413
  severity:'CRITICAL',\
374
414
  setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
375
415
 
376
416
 
377
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:921015,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-921-PROTOCOL-ATTACK"
378
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:921016,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-921-PROTOCOL-ATTACK"
417
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:921015,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-921-PROTOCOL-ATTACK"
418
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:921016,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-921-PROTOCOL-ATTACK"
379
419
  #
380
420
  # -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)
381
421
  #
@@ -404,8 +444,9 @@ SecRule &REQUEST_HEADERS:Range "@gt 0" \
404
444
  tag:'attack-protocol',\
405
445
  tag:'paranoia-level/3',\
406
446
  tag:'OWASP_CRS',\
447
+ tag:'OWASP_CRS/PROTOCOL-ATTACK',\
407
448
  tag:'capec/1000/210/272/220',\
408
- ver:'OWASP_CRS/4.9.0',\
449
+ ver:'OWASP_CRS/4.16.0',\
409
450
  severity:'CRITICAL',\
410
451
  setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'"
411
452
 
@@ -438,8 +479,9 @@ SecRule ARGS_NAMES "@rx ." \
438
479
  tag:'platform-multi',\
439
480
  tag:'attack-protocol',\
440
481
  tag:'OWASP_CRS',\
482
+ tag:'OWASP_CRS/PROTOCOL-ATTACK',\
441
483
  tag:'capec/1000/152/137/15/460',\
442
- ver:'OWASP_CRS/4.9.0',\
484
+ ver:'OWASP_CRS/4.16.0',\
443
485
  setvar:'TX.paramcounter_%{MATCHED_VAR_NAME}=+1'"
444
486
 
445
487
  SecRule TX:/paramcounter_.*/ "@gt 1" \
@@ -454,8 +496,9 @@ SecRule TX:/paramcounter_.*/ "@gt 1" \
454
496
  tag:'attack-protocol',\
455
497
  tag:'paranoia-level/3',\
456
498
  tag:'OWASP_CRS',\
499
+ tag:'OWASP_CRS/PROTOCOL-ATTACK',\
457
500
  tag:'capec/1000/152/137/15/460',\
458
- ver:'OWASP_CRS/4.9.0',\
501
+ ver:'OWASP_CRS/4.16.0',\
459
502
  severity:'CRITICAL',\
460
503
  setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\
461
504
  setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'"
@@ -496,16 +539,17 @@ SecRule ARGS_NAMES "@rx (][^\]]+$|][^\]]+\[)" \
496
539
  tag:'attack-protocol',\
497
540
  tag:'paranoia-level/3',\
498
541
  tag:'OWASP_CRS',\
542
+ tag:'OWASP_CRS/PROTOCOL-ATTACK',\
499
543
  tag:'capec/1000/152/137/15/460',\
500
- ver:'OWASP_CRS/4.9.0',\
544
+ ver:'OWASP_CRS/4.16.0',\
501
545
  severity:'CRITICAL',\
502
546
  setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\
503
547
  setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'"
504
548
 
505
549
 
506
550
 
507
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:921017,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-921-PROTOCOL-ATTACK"
508
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:921018,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-921-PROTOCOL-ATTACK"
551
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:921017,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-921-PROTOCOL-ATTACK"
552
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:921018,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-921-PROTOCOL-ATTACK"
509
553
  #
510
554
  # -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)
511
555
  #
@@ -544,8 +588,9 @@ SecRule ARGS_NAMES "@rx \[" \
544
588
  tag:'attack-protocol',\
545
589
  tag:'paranoia-level/4',\
546
590
  tag:'OWASP_CRS',\
591
+ tag:'OWASP_CRS/PROTOCOL-ATTACK',\
547
592
  tag:'capec/1000/152/137/15/460',\
548
- ver:'OWASP_CRS/4.9.0',\
593
+ ver:'OWASP_CRS/4.16.0',\
549
594
  severity:'CRITICAL',\
550
595
  setvar:'tx.http_violation_score=+%{tx.critical_anomaly_score}',\
551
596
  setvar:'tx.inbound_anomaly_score_pl4=+%{tx.critical_anomaly_score}'"
package/lib/nginx/includes/security/crs4/rules/REQUEST-922-MULTIPART-ATTACK.conf CHANGED
@@ -1,7 +1,7 @@
1
1
  # ------------------------------------------------------------------------
2
- # OWASP CRS ver.4.9.0
2
+ # OWASP CRS ver.4.16.0
3
3
  # Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
4
- # Copyright (c) 2021-2024 CRS project. All rights reserved.
4
+ # Copyright (c) 2021-2025 CRS project. All rights reserved.
5
5
  #
6
6
  # The OWASP CRS is distributed under
7
7
  # Apache Software License (ASL) version 2
@@ -37,8 +37,9 @@ SecRule &MULTIPART_PART_HEADERS:_charset_ "!@eq 0" \
37
37
  tag:'attack-multipart-header',\
38
38
  tag:'paranoia-level/1',\
39
39
  tag:'OWASP_CRS',\
40
+ tag:'OWASP_CRS/MULTIPART-ATTACK',\
40
41
  tag:'capec/1000/255/153',\
41
- ver:'OWASP_CRS/4.9.0',\
42
+ ver:'OWASP_CRS/4.16.0',\
42
43
  severity:'CRITICAL',\
43
44
  setvar:'tx.922100_charset=|%{ARGS._charset_}|',\
44
45
  chain"
@@ -65,11 +66,13 @@ SecRule MULTIPART_PART_HEADERS "@rx ^content-type\s*:\s*(.*)$" \
65
66
  tag:'application-multi',\
66
67
  tag:'language-multi',\
67
68
  tag:'platform-multi',\
69
+ tag:'attack-multipart-header',\
68
70
  tag:'attack-protocol',\
69
71
  tag:'paranoia-level/1',\
70
72
  tag:'OWASP_CRS',\
73
+ tag:'OWASP_CRS/MULTIPART-ATTACK',\
71
74
  tag:'capec/272/220',\
72
- ver:'OWASP_CRS/4.9.0',\
75
+ ver:'OWASP_CRS/4.16.0',\
73
76
  severity:'CRITICAL',\
74
77
  chain"
75
78
  SecRule TX:1 "!@rx ^(?:(?:\*|[^!\"\(\),/:-\?\[-\]\{\}]+)/(?:\*|[^!\"\(\),/:-\?\[-\]\{\}]+)|\*)(?:[\s\x0b]*;[\s\x0b]*(?:charset[\s\x0b]*=[\s\x0b]*\"?(?:iso-8859-15?|utf-8|windows-1252)\b\"?|(?:[^\s\x0b-\"\(\),/:-\?\[-\]c\{\}]|c(?:[^!\"\(\),/:-\?\[-\]h\{\}]|h(?:[^!\"\(\),/:-\?\[-\]a\{\}]|a(?:[^!\"\(\),/:-\?\[-\]r\{\}]|r(?:[^!\"\(\),/:-\?\[-\]s\{\}]|s(?:[^!\"\(\),/:-\?\[-\]e\{\}]|e[^!\"\(\),/:-\?\[-\]t\{\}]))))))[^!\"\(\),/:-\?\[-\]\{\}]*[\s\x0b]*=[\s\x0b]*[^!\(\),/:-\?\[-\]\{\}]+);?)*(?:[\s\x0b]*,[\s\x0b]*(?:(?:\*|[^!\"\(\),/:-\?\[-\]\{\}]+)/(?:\*|[^!\"\(\),/:-\?\[-\]\{\}]+)|\*)(?:[\s\x0b]*;[\s\x0b]*(?:charset[\s\x0b]*=[\s\x0b]*\"?(?:iso-8859-15?|utf-8|windows-1252)\b\"?|(?:[^\s\x0b-\"\(\),/:-\?\[-\]c\{\}]|c(?:[^!\"\(\),/:-\?\[-\]h\{\}]|h(?:[^!\"\(\),/:-\?\[-\]a\{\}]|a(?:[^!\"\(\),/:-\?\[-\]r\{\}]|r(?:[^!\"\(\),/:-\?\[-\]s\{\}]|s(?:[^!\"\(\),/:-\?\[-\]e\{\}]|e[^!\"\(\),/:-\?\[-\]t\{\}]))))))[^!\"\(\),/:-\?\[-\]\{\}]*[\s\x0b]*=[\s\x0b]*[^!\(\),/:-\?\[-\]\{\}]+);?)*)*$" \
@@ -88,11 +91,13 @@ SecRule MULTIPART_PART_HEADERS "@rx content-transfer-encoding:(.*)" \
88
91
  tag:'application-multi',\
89
92
  tag:'language-multi',\
90
93
  tag:'platform-multi',\
94
+ tag:'attack-multipart-header',\
91
95
  tag:'attack-deprecated-header',\
92
96
  tag:'paranoia-level/1',\
93
97
  tag:'OWASP_CRS',\
98
+ tag:'OWASP_CRS/MULTIPART-ATTACK',\
94
99
  tag:'capec/272/220',\
95
- ver:'OWASP_CRS/4.9.0',\
100
+ ver:'OWASP_CRS/4.16.0',\
96
101
  severity:'CRITICAL',\
97
102
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
98
103
 
@@ -114,7 +119,8 @@ SecRule MULTIPART_PART_HEADERS "@rx [^\x21-\x7E][\x21-\x39\x3B-\x7E]*:" \
114
119
  tag:'attack-multipart-header',\
115
120
  tag:'paranoia-level/1',\
116
121
  tag:'OWASP_CRS',\
122
+ tag:'OWASP_CRS/MULTIPART-ATTACK',\
117
123
  tag:'capec/272/220',\
118
- ver:'OWASP_CRS/4.9.0',\
124
+ ver:'OWASP_CRS/4.16.0',\
119
125
  severity:'CRITICAL',\
120
126
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
package/lib/nginx/includes/security/crs4/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf CHANGED
@@ -1,7 +1,7 @@
1
1
  # ------------------------------------------------------------------------
2
- # OWASP CRS ver.4.9.0
2
+ # OWASP CRS ver.4.16.0
3
3
  # Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
4
- # Copyright (c) 2021-2024 CRS project. All rights reserved.
4
+ # Copyright (c) 2021-2025 CRS project. All rights reserved.
5
5
  #
6
6
  # The OWASP CRS is distributed under
7
7
  # Apache Software License (ASL) version 2
@@ -14,8 +14,8 @@
14
14
 
15
15
 
16
16
 
17
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:930011,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-930-APPLICATION-ATTACK-LFI"
18
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:930012,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-930-APPLICATION-ATTACK-LFI"
17
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:930011,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-930-APPLICATION-ATTACK-LFI"
18
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:930012,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-930-APPLICATION-ATTACK-LFI"
19
19
  #
20
20
  # -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)
21
21
  #
@@ -46,8 +46,9 @@ SecRule REQUEST_URI_RAW|ARGS|REQUEST_HEADERS|!REQUEST_HEADERS:Referer|FILES|XML:
46
46
  tag:'attack-lfi',\
47
47
  tag:'paranoia-level/1',\
48
48
  tag:'OWASP_CRS',\
49
+ tag:'OWASP_CRS/ATTACK-LFI',\
49
50
  tag:'capec/1000/255/153/126',\
50
- ver:'OWASP_CRS/4.9.0',\
51
+ ver:'OWASP_CRS/4.16.0',\
51
52
  severity:'CRITICAL',\
52
53
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
53
54
  setvar:'tx.lfi_score=+%{tx.critical_anomaly_score}'"
@@ -64,7 +65,7 @@ SecRule REQUEST_URI_RAW|ARGS|REQUEST_HEADERS|!REQUEST_HEADERS:Referer|FILES|XML:
64
65
  #
65
66
  # Semicolon added to prevent path traversal via reverse proxy mapping '/..;/' (Tomcat)
66
67
  #
67
- SecRule REQUEST_URI|ARGS|REQUEST_HEADERS|!REQUEST_HEADERS:Referer|FILES|XML:/* "@rx (?:(?:^|[\x5c/;])\.{2,3}[\x5c/;]|[\x5c/;]\.{2,3}(?:[\x5c/;]|$))" \
68
+ SecRule REQUEST_URI_RAW|ARGS|REQUEST_HEADERS|!REQUEST_HEADERS:Referer|FILES|XML:/* "@rx (?:(?:^|[\x5c/;])\.{2,3}[\x5c/;]|[\x5c/;]\.{2,3}[\x5c/;])" \
68
69
  "id:930110,\
69
70
  phase:2,\
70
71
  block,\
@@ -78,8 +79,9 @@ SecRule REQUEST_URI|ARGS|REQUEST_HEADERS|!REQUEST_HEADERS:Referer|FILES|XML:/* "
78
79
  tag:'attack-lfi',\
79
80
  tag:'paranoia-level/1',\
80
81
  tag:'OWASP_CRS',\
82
+ tag:'OWASP_CRS/ATTACK-LFI',\
81
83
  tag:'capec/1000/255/153/126',\
82
- ver:'OWASP_CRS/4.9.0',\
84
+ ver:'OWASP_CRS/4.16.0',\
83
85
  severity:'CRITICAL',\
84
86
  multiMatch,\
85
87
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
@@ -94,7 +96,7 @@ SecRule REQUEST_URI|ARGS|REQUEST_HEADERS|!REQUEST_HEADERS:Referer|FILES|XML:/* "
94
96
  #
95
97
  # If you wonder where support for Google OAuth2 has gone, see:
96
98
  # https://github.com/coreruleset/google-oauth2-plugin
97
- SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@pmFromFile lfi-os-files.data" \
99
+ SecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@pmFromFile lfi-os-files.data" \
98
100
  "id:930120,\
99
101
  phase:2,\
100
102
  block,\
@@ -108,9 +110,10 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME
108
110
  tag:'attack-lfi',\
109
111
  tag:'paranoia-level/1',\
110
112
  tag:'OWASP_CRS',\
113
+ tag:'OWASP_CRS/ATTACK-LFI',\
111
114
  tag:'capec/1000/255/153/126',\
112
115
  tag:'PCI/6.5.4',\
113
- ver:'OWASP_CRS/4.9.0',\
116
+ ver:'OWASP_CRS/4.16.0',\
114
117
  severity:'CRITICAL',\
115
118
  setvar:'tx.lfi_score=+%{tx.critical_anomaly_score}',\
116
119
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
@@ -135,17 +138,18 @@ SecRule REQUEST_FILENAME "@pmFromFile restricted-files.data" \
135
138
  tag:'attack-lfi',\
136
139
  tag:'paranoia-level/1',\
137
140
  tag:'OWASP_CRS',\
141
+ tag:'OWASP_CRS/ATTACK-LFI',\
138
142
  tag:'capec/1000/255/153/126',\
139
143
  tag:'PCI/6.5.4',\
140
- ver:'OWASP_CRS/4.9.0',\
144
+ ver:'OWASP_CRS/4.16.0',\
141
145
  severity:'CRITICAL',\
142
146
  setvar:'tx.lfi_score=+%{tx.critical_anomaly_score}',\
143
147
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
144
148
 
145
149
 
146
150
 
147
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:930013,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-930-APPLICATION-ATTACK-LFI"
148
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:930014,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-930-APPLICATION-ATTACK-LFI"
151
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:930013,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-930-APPLICATION-ATTACK-LFI"
152
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:930014,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-930-APPLICATION-ATTACK-LFI"
149
153
  #
150
154
  # -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)
151
155
  #
@@ -173,24 +177,25 @@ SecRule REQUEST_HEADERS:Referer|REQUEST_HEADERS:User-Agent "@pmFromFile lfi-os-f
173
177
  tag:'attack-lfi',\
174
178
  tag:'paranoia-level/2',\
175
179
  tag:'OWASP_CRS',\
180
+ tag:'OWASP_CRS/ATTACK-LFI',\
176
181
  tag:'capec/1000/255/153/126',\
177
182
  tag:'PCI/6.5.4',\
178
- ver:'OWASP_CRS/4.9.0',\
183
+ ver:'OWASP_CRS/4.16.0',\
179
184
  severity:'CRITICAL',\
180
185
  setvar:'tx.lfi_score=+%{tx.critical_anomaly_score}',\
181
186
  setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
182
187
 
183
188
 
184
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:930015,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-930-APPLICATION-ATTACK-LFI"
185
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:930016,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-930-APPLICATION-ATTACK-LFI"
189
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:930015,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-930-APPLICATION-ATTACK-LFI"
190
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:930016,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-930-APPLICATION-ATTACK-LFI"
186
191
  #
187
192
  # -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)
188
193
  #
189
194
 
190
195
 
191
196
 
192
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:930017,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-930-APPLICATION-ATTACK-LFI"
193
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:930018,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-930-APPLICATION-ATTACK-LFI"
197
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:930017,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-930-APPLICATION-ATTACK-LFI"
198
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:930018,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-930-APPLICATION-ATTACK-LFI"
194
199
  #
195
200
  # -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)
196
201
  #
package/lib/nginx/includes/security/crs4/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf CHANGED
@@ -1,7 +1,7 @@
1
1
  # ------------------------------------------------------------------------
2
- # OWASP CRS ver.4.9.0
2
+ # OWASP CRS ver.4.16.0
3
3
  # Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
4
- # Copyright (c) 2021-2024 CRS project. All rights reserved.
4
+ # Copyright (c) 2021-2025 CRS project. All rights reserved.
5
5
  #
6
6
  # The OWASP CRS is distributed under
7
7
  # Apache Software License (ASL) version 2
@@ -17,8 +17,8 @@
17
17
 
18
18
 
19
19
 
20
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:931011,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-931-APPLICATION-ATTACK-RFI"
21
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:931012,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-931-APPLICATION-ATTACK-RFI"
20
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:931011,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-931-APPLICATION-ATTACK-RFI"
21
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:931012,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-931-APPLICATION-ATTACK-RFI"
22
22
  #
23
23
  # -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)
24
24
  #
@@ -48,8 +48,9 @@ SecRule ARGS "@rx ^(?i:file|ftps?|https?)://(?:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3
48
48
  tag:'attack-rfi',\
49
49
  tag:'paranoia-level/1',\
50
50
  tag:'OWASP_CRS',\
51
+ tag:'OWASP_CRS/ATTACK-RFI',\
51
52
  tag:'capec/1000/152/175/253',\
52
- ver:'OWASP_CRS/4.9.0',\
53
+ ver:'OWASP_CRS/4.16.0',\
53
54
  severity:'CRITICAL',\
54
55
  setvar:'tx.rfi_score=+%{tx.critical_anomaly_score}',\
55
56
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
@@ -68,8 +69,9 @@ SecRule QUERY_STRING|REQUEST_BODY "@rx (?i)(?:\binclude\s*\([^)]*|mosConfig_abso
68
69
  tag:'attack-rfi',\
69
70
  tag:'paranoia-level/1',\
70
71
  tag:'OWASP_CRS',\
72
+ tag:'OWASP_CRS/ATTACK-RFI',\
71
73
  tag:'capec/1000/152/175/253',\
72
- ver:'OWASP_CRS/4.9.0',\
74
+ ver:'OWASP_CRS/4.16.0',\
73
75
  severity:'CRITICAL',\
74
76
  setvar:'tx.rfi_score=+%{tx.critical_anomaly_score}',\
75
77
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
@@ -88,16 +90,17 @@ SecRule ARGS "@rx ^(?i:file|ftps?|https?).*?\?+$" \
88
90
  tag:'attack-rfi',\
89
91
  tag:'paranoia-level/1',\
90
92
  tag:'OWASP_CRS',\
93
+ tag:'OWASP_CRS/ATTACK-RFI',\
91
94
  tag:'capec/1000/152/175/253',\
92
- ver:'OWASP_CRS/4.9.0',\
95
+ ver:'OWASP_CRS/4.16.0',\
93
96
  severity:'CRITICAL',\
94
97
  setvar:'tx.rfi_score=+%{tx.critical_anomaly_score}',\
95
98
  setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
96
99
 
97
100
 
98
101
 
99
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:931013,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-931-APPLICATION-ATTACK-RFI"
100
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:931014,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-931-APPLICATION-ATTACK-RFI"
102
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:931013,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-931-APPLICATION-ATTACK-RFI"
103
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:931014,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-931-APPLICATION-ATTACK-RFI"
101
104
  #
102
105
  # -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)
103
106
  #
@@ -127,8 +130,9 @@ SecRule ARGS "@rx (?i)(?:(?:url|jar):)?(?:a(?:cap|f[ps]|ttachment)|b(?:eshare|it
127
130
  tag:'attack-rfi',\
128
131
  tag:'paranoia-level/2',\
129
132
  tag:'OWASP_CRS',\
133
+ tag:'OWASP_CRS/ATTACK-RFI',\
130
134
  tag:'capec/1000/152/175/253',\
131
- ver:'OWASP_CRS/4.9.0',\
135
+ ver:'OWASP_CRS/4.16.0',\
132
136
  severity:'CRITICAL',\
133
137
  setvar:'tx.rfi_parameter_%{MATCHED_VAR_NAME}=.%{tx.1}',\
134
138
  chain"
@@ -157,8 +161,9 @@ SecRule REQUEST_FILENAME "@rx (?i)(?:(?:url|jar):)?(?:a(?:cap|f[ps]|ttachment)|b
157
161
  tag:'attack-rfi',\
158
162
  tag:'paranoia-level/2',\
159
163
  tag:'OWASP_CRS',\
164
+ tag:'OWASP_CRS/ATTACK-RFI',\
160
165
  tag:'capec/1000/152/175/253',\
161
- ver:'OWASP_CRS/4.9.0',\
166
+ ver:'OWASP_CRS/4.16.0',\
162
167
  severity:'CRITICAL',\
163
168
  setvar:'tx.rfi_parameter_%{MATCHED_VAR_NAME}=.%{tx.1}',\
164
169
  chain"
@@ -167,16 +172,16 @@ SecRule REQUEST_FILENAME "@rx (?i)(?:(?:url|jar):)?(?:a(?:cap|f[ps]|ttachment)|b
167
172
  setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
168
173
 
169
174
 
170
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:931015,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-931-APPLICATION-ATTACK-RFI"
171
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:931016,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-931-APPLICATION-ATTACK-RFI"
175
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:931015,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-931-APPLICATION-ATTACK-RFI"
176
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:931016,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-931-APPLICATION-ATTACK-RFI"
172
177
  #
173
178
  # -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)
174
179
  #
175
180
 
176
181
 
177
182
 
178
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:931017,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-931-APPLICATION-ATTACK-RFI"
179
- SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:931018,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-REQUEST-931-APPLICATION-ATTACK-RFI"
183
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:931017,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-931-APPLICATION-ATTACK-RFI"
184
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:931018,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.16.0',skipAfter:END-REQUEST-931-APPLICATION-ATTACK-RFI"
180
185
  #
181
186
  # -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)
182
187
  #