fix(waf): CRS v4 Regeln extrahiert + Control-Flow-Regeln filtern — v1.2.82
- crsRules.ts neu: 331 echte CRS v4.7.0 Regeln aus installierten Dateien (v3-Nummernschema war falsch, v4 hat andere IDs — 949152 war skip-Regel) - spoe.go: Regeln ohne Message nicht als Alert speichern Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Debian
@@ -132,10 +132,17 @@ func (a *SPOEAgent) handle(ctx context.Context, w *encoding.ActionWriter, m *enc
|
|||||||
}
|
}
|
||||||
|
|
||||||
// sendAlert enqueues a WAF alert for async DB write.
|
// sendAlert enqueues a WAF alert for async DB write.
|
||||||
|
// Control-flow rules (pass+nolog with empty message) are skipped —
|
||||||
|
// they are CRS paranoia-level skip-markers, not real detections.
|
||||||
func (a *SPOEAgent) sendAlert(host, clientIP, method, uri string, mr types.MatchedRule, blocked bool) {
|
func (a *SPOEAgent) sendAlert(host, clientIP, method, uri string, mr types.MatchedRule, blocked bool) {
|
||||||
if a.AlertWriter == nil {
|
if a.AlertWriter == nil {
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
|
// Skip rules with no message — these are CRS skip/control-flow rules
|
||||||
|
// (e.g. 949011..949018, 911011..911018) that match but carry no alert info.
|
||||||
|
if mr.Message() == "" && mr.Rule().ID() > 0 {
|
||||||
|
return
|
||||||
|
}
|
||||||
action := "detected"
|
action := "detected"
|
||||||
if blocked && mr.Disruptive() {
|
if blocked && mr.Disruptive() {
|
||||||
action = "blocked"
|
action = "blocked"
|
||||||
|
|||||||
@@ -1,351 +1,342 @@
|
|||||||
/**
|
/**
|
||||||
* OWASP Core Rule Set (CRS) v4.x — rule descriptions.
|
* OWASP CRS v4.7.0 — rule descriptions (auto-generated from installed CRS).
|
||||||
* Source: https://coreruleset.org / CRS GitHub
|
* Update by running the extraction script when upgrading CRS.
|
||||||
* Static map: rule_id → short description (EN).
|
|
||||||
* New rules added per CRS release; update this file when upgrading CRS.
|
|
||||||
*/
|
*/
|
||||||
export const CRS_RULES: Record<number, string> = {
|
export const CRS_RULES: Record<number, string> = {
|
||||||
// ── 900xxx Setup ───────────────────────────────────────────────────────
|
901001: "ModSecurity CRS is deployed without configuration! Please copy the crs-setup.conf.example template to crs-setup.conf,...",
|
||||||
900000: 'CRS: Set paranoia level',
|
901100: "Enabling body inspection",
|
||||||
900001: 'CRS: Set anomaly thresholds',
|
901350: "Enabling forced body inspection for ASCII content",
|
||||||
900110: 'CRS: Anomaly scoring threshold configuration',
|
901400: "Sampling: Disable the rule engine based on sampling_percentage <pct> and random number <rnd>",
|
||||||
900200: 'CRS: Allowed HTTP versions',
|
901500: "Detection paranoia level configured is lower than the paranoia level itself. This is illegal. Blocking request. Aborting",
|
||||||
900220: 'CRS: Allowed request content types',
|
911011: "Method is not allowed by policy",
|
||||||
|
913011: "Found User-Agent associated with security scanner",
|
||||||
// ── 901xxx Initialization ──────────────────────────────────────────────
|
920011: "Invalid HTTP Request Line",
|
||||||
901001: 'CRS: Version check — unsupported CRS version',
|
920013: "Range: Too many fields (6 or more)",
|
||||||
901100: 'CRS: Anomaly scoring initialization',
|
920015: "Invalid character in request (outside of printable chars below ascii 127)",
|
||||||
|
920017: "Range: Too many fields for pdf request (6 or more)",
|
||||||
// ── 903xxx / 905xxx Protocol enforcement ──────────────────────────────
|
920120: "Attempted multipart/form-data bypass",
|
||||||
903100: 'Protocol enforcement: missing Host header',
|
920121: "Attempted multipart/form-data bypass",
|
||||||
905100: 'Protocol enforcement: HTTP/0.9 request',
|
920160: "Content-Length HTTP header is not numeric",
|
||||||
|
920170: "GET or HEAD Request with Body Content",
|
||||||
// ── 910xxx IP reputation ───────────────────────────────────────────────
|
920171: "GET or HEAD Request with Transfer-Encoding",
|
||||||
910100: 'IP reputation: client IP in GeoIP blocklist',
|
920180: "POST without Content-Length or Transfer-Encoding headers",
|
||||||
910110: 'IP reputation: client IP in DNSBL blocklist',
|
920181: "Content-Length and Transfer-Encoding headers present",
|
||||||
910120: 'IP reputation: Sqli/XSS IP reputation',
|
920190: "Range: Invalid Last Byte Value",
|
||||||
910130: 'IP reputation: Spamhaus DROP list',
|
920201: "Range: Too many fields for pdf request (63 or more)",
|
||||||
910150: 'IP reputation: project Honeypot',
|
920210: "Multiple/Conflicting Connection Header Data Found",
|
||||||
910160: 'IP reputation: project Honeypot — comment spammer',
|
920220: "URL Encoding Abuse Attack Attempt",
|
||||||
910170: 'IP reputation: project Honeypot — suspicious IP',
|
920221: "URL Encoding Abuse Attack Attempt",
|
||||||
910180: 'IP reputation: known scanners/hacking tool IP',
|
920230: "Multiple URL Encoding Detected",
|
||||||
|
920240: "URL Encoding Abuse Attack Attempt",
|
||||||
// ── 911xxx Method enforcement ──────────────────────────────────────────
|
920250: "UTF8 Encoding Abuse Attack Attempt",
|
||||||
911100: 'Method not allowed for this resource',
|
920260: "Unicode Full/Half Width Abuse Attack Attempt",
|
||||||
|
920270: "Invalid character in request (null character)",
|
||||||
// ── 912xxx DoS / rate limiting ─────────────────────────────────────────
|
920271: "Invalid character in request (non printable characters)",
|
||||||
912120: 'DoS: too many requests from single IP',
|
920273: "Invalid character in request (outside of very strict set)",
|
||||||
|
920274: "Invalid character in request headers (outside of very strict set)",
|
||||||
// ── 913xxx Scanner detection ───────────────────────────────────────────
|
920275: "Invalid character in request headers (outside of very strict set)",
|
||||||
913100: 'Scanner: security scanner User-Agent detected',
|
920280: "Request Missing a Host Header",
|
||||||
913101: 'Scanner: scripting/generic HTTP client User-Agent',
|
920290: "Empty Host Header",
|
||||||
913102: 'Scanner: web crawler/bot User-Agent',
|
920300: "Request Missing an Accept Header",
|
||||||
913110: 'Scanner: request header associated with security scanner',
|
920310: "Request Has an Empty Accept Header",
|
||||||
913120: 'Scanner: request filename/argument associated with scanner',
|
920311: "Request Has an Empty Accept Header",
|
||||||
|
920320: "Missing User Agent Header",
|
||||||
// ── 920xxx Protocol enforcement (request) ─────────────────────────────
|
920330: "Empty User Agent Header",
|
||||||
920100: 'Protocol: invalid HTTP request line',
|
920340: "Request Containing Content, but Missing Content-Type header",
|
||||||
920120: 'Protocol: attempted multipart/form-data bypass',
|
920341: "Request Containing Content Requires Content-Type header",
|
||||||
920121: 'Protocol: attempted multipart/form-data bypass (2)',
|
920350: "Host header is a numeric IP address",
|
||||||
920130: 'Protocol: failed to parse request body',
|
920360: "Argument name too long",
|
||||||
920140: 'Protocol: multipart request body failed strict validation',
|
920370: "Argument value too long",
|
||||||
920160: 'Protocol: Content-Length HTTP header is not numeric',
|
920380: "Too many arguments in request",
|
||||||
920170: 'Protocol: GET/HEAD request with body content',
|
920390: "Total arguments size exceeded",
|
||||||
920171: 'Protocol: GET/HEAD request with Transfer-Encoding',
|
920400: "Uploaded file size too large",
|
||||||
920180: 'Protocol: POST request missing Content-Length or Transfer-Encoding',
|
920410: "Total uploaded files size too large",
|
||||||
920181: 'Protocol: Content-Length and Transfer-Encoding headers present',
|
920420: "Request content type is not allowed by policy",
|
||||||
920190: 'Protocol: range header contains an invalid last byte value',
|
920430: "HTTP protocol version is not allowed by policy",
|
||||||
920200: 'Protocol: range header contains too many fields',
|
920440: "URL file extension is restricted by policy",
|
||||||
920201: 'Protocol: range header contains too many fields for PDF request',
|
920450: "HTTP header is restricted by policy (<matched>)",
|
||||||
920210: 'Protocol: multiple/conflicting connection header data',
|
920451: "HTTP header is restricted by policy (<matched>)",
|
||||||
920220: 'Protocol: URL encoding abuse attack attempt',
|
920460: "Abnormal character escapes in request",
|
||||||
920230: 'Protocol: multiple URL encoding detected',
|
920470: "Illegal Content-Type header",
|
||||||
920240: 'Protocol: URL encoding abuse in request headers',
|
920480: "Request content type charset is not allowed by policy",
|
||||||
920250: 'Protocol: UTF8 encoding abuse attack attempt',
|
920490: "Request header x-up-devcap-post-charset detected in combination with prefix \\",
|
||||||
920260: 'Protocol: Unicode full/half width abuse attack attempt',
|
920500: "Attempt to access a backup or working file",
|
||||||
920270: 'Protocol: invalid character in request (null character)',
|
920510: "Invalid Cache-Control request header",
|
||||||
920271: 'Protocol: invalid character in request (non-printable)',
|
920520: "Accept-Encoding header exceeded sensible length",
|
||||||
920272: 'Protocol: invalid character in request (outside printable ASCII)',
|
920521: "Illegal Accept-Encoding header",
|
||||||
920273: 'Protocol: invalid character in request (outside very strict range)',
|
920530: "Multiple charsets detected in content type header",
|
||||||
920274: 'Protocol: invalid character in request headers (outside very strict range)',
|
920540: "Possible Unicode character bypass detected",
|
||||||
920280: 'Protocol: request missing Host header',
|
920600: "Illegal Accept header: charset parameter",
|
||||||
920290: 'Protocol: empty Host header',
|
920610: "Raw (unencoded) fragment in request URI",
|
||||||
920300: 'Protocol: request missing Accept header',
|
920620: "Multiple Content-Type Request Headers",
|
||||||
920310: 'Protocol: request has empty Accept header',
|
921011: "HTTP Request Smuggling Attack",
|
||||||
920311: 'Protocol: request has empty Accept header (2)',
|
921013: "HTTP Header Injection Attack via payload (CR/LF detected)",
|
||||||
920320: 'Protocol: request missing User-Agent header',
|
921015: "HTTP Range Header detected",
|
||||||
920330: 'Protocol: empty User-Agent header',
|
921017: "HTTP Parameter Pollution possible via array notation",
|
||||||
920340: 'Protocol: request with content but no Content-Type header',
|
921120: "HTTP Response Splitting Attack",
|
||||||
920341: 'Protocol: request with content requires Content-Type header',
|
921130: "HTTP Response Splitting Attack",
|
||||||
920350: 'Protocol: Host header is a numeric IP address',
|
921140: "HTTP Header Injection Attack via headers",
|
||||||
920360: 'Protocol: argument name too long',
|
921150: "HTTP Header Injection Attack via payload (CR/LF detected)",
|
||||||
920370: 'Protocol: argument value too long',
|
921160: "HTTP Header Injection Attack via payload (CR/LF and header-name detected)",
|
||||||
920380: 'Protocol: too many arguments in request',
|
921170: "HTTP Parameter Pollution (<var>)",
|
||||||
920390: 'Protocol: total arguments size exceeded',
|
921190: "HTTP Splitting (CR/LF in request filename detected)",
|
||||||
920400: 'Protocol: uploaded file too large',
|
921200: "LDAP Injection Attack",
|
||||||
920410: 'Protocol: total uploaded files size too large',
|
921210: "HTTP Parameter Pollution after detecting bogus char after parameter array",
|
||||||
920420: 'Protocol: request content type is not allowed',
|
921240: "mod_proxy attack attempt detected",
|
||||||
920430: 'Protocol: HTTP protocol version not allowed',
|
921421: "Content-Type header: Dangerous content type outside the mime type declaration",
|
||||||
920440: 'Protocol: URL file extension restricted by policy',
|
921422: "Content-Type header: Dangerous content type outside the mime type declaration",
|
||||||
920450: 'Protocol: HTTP header is restricted by policy',
|
922100: "Multipart content type global _charset_ definition is not allowed by policy",
|
||||||
920460: 'Protocol: abnormal escape character in request',
|
922110: "Illegal MIME Multipart Header content-type: charset parameter",
|
||||||
920470: 'Protocol: illegal Content-Type header',
|
922120: "Content-Transfer-Encoding was deprecated by rfc7578 in 2015 and should not be used",
|
||||||
920480: 'Protocol: request Content-Type charset restricted',
|
922130: "Multipart header contains characters outside of valid range",
|
||||||
920500: 'Protocol: attempt to access a backup or working file',
|
930011: "Path Traversal Attack (/../) or (/.../)",
|
||||||
920510: 'Protocol: file extension blocked for security reasons',
|
930013: "OS File Access Attempt in REQUEST_HEADERS",
|
||||||
920520: 'Protocol: missing or invalid "nonce" value in request',
|
930110: "Path Traversal Attack (/../) or (/.../)",
|
||||||
|
930120: "OS File Access Attempt",
|
||||||
// ── 921xxx HTTP request smuggling ─────────────────────────────────────
|
930130: "Restricted File Access Attempt",
|
||||||
921100: 'Request smuggling: HTTP request smuggling attack',
|
931011: "Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address",
|
||||||
921110: 'Request smuggling: HTTP request smuggling in request headers',
|
931013: "Possible Remote File Inclusion (RFI) Attack: Off-Domain Reference/Link",
|
||||||
921120: 'Request smuggling: HTTP response splitting attack',
|
931110: "Possible Remote File Inclusion (RFI) Attack: Common RFI Vulnerable Parameter Name used w/URL Payload",
|
||||||
921130: 'Request smuggling: HTTP response splitting attack (2)',
|
931120: "Possible Remote File Inclusion (RFI) Attack: URL Payload Used w/Trailing Question Mark Character (?)",
|
||||||
921140: 'Request smuggling: HTTP header injection via headers',
|
931131: "Possible Remote File Inclusion (RFI) Attack: Off-Domain Reference/Link",
|
||||||
921150: 'Request smuggling: HTTP header injection via parameters (CR/LF)',
|
932011: "Remote Command Execution: Unix Command Injection (2-3 chars)",
|
||||||
921151: 'Request smuggling: HTTP header injection via parameters (CR/LF, 2)',
|
932013: "Remote Command Execution: Unix Command Injection",
|
||||||
921160: 'Request smuggling: HTTP splitting (CR/LF and header-name found)',
|
932015: "Remote Command Execution: Unix Command Injection",
|
||||||
921170: 'Request smuggling: HTTP parameter pollution',
|
932120: "Remote Command Execution: Windows PowerShell Command Found",
|
||||||
921180: 'Request smuggling: HTTP parameter pollution (matched var found)',
|
932125: "Remote Command Execution: Windows Powershell Alias Command Injection",
|
||||||
|
932130: "Remote Command Execution: Unix Shell Expression Found",
|
||||||
// ── 922xxx File upload ─────────────────────────────────────────────────
|
932131: "Remote Command Execution: Unix Shell Expression Found",
|
||||||
922100: 'File upload: multipart bypass in Content-Disposition',
|
932140: "Remote Command Execution: Windows FOR/IF Command Found",
|
||||||
922110: 'File upload: multipart bypass in Content-Type',
|
932160: "Remote Command Execution: Unix Shell Code Found",
|
||||||
922120: 'File upload: filename contains null character',
|
932161: "Remote Command Execution: Unix Shell Code Found in REQUEST_HEADERS",
|
||||||
922130: 'File upload: filename contains newline',
|
932170: "Remote Command Execution: Shellshock (CVE-2014-6271)",
|
||||||
|
932171: "Remote Command Execution: Shellshock (CVE-2014-6271)",
|
||||||
// ── 930xxx LFI — local file inclusion ─────────────────────────────────
|
932175: "Remote Command Execution: Unix shell alias invocation",
|
||||||
930100: 'LFI: path traversal attack (/../)',
|
932180: "Restricted File Upload Attempt",
|
||||||
930110: 'LFI: path traversal attack (/../) with special chars',
|
932190: "Remote Command Execution: Wildcard bypass technique attempt",
|
||||||
930120: 'LFI: OS file access attempt',
|
932200: "RCE Bypass Technique",
|
||||||
930130: 'LFI: restricted file access attempt',
|
932205: "RCE Bypass Technique",
|
||||||
|
932206: "RCE Bypass Technique",
|
||||||
// ── 931xxx RFI — remote file inclusion ───────────────────────────────
|
932210: "Remote Command Execution: SQLite System Command Execution",
|
||||||
931100: 'RFI: possible remote file inclusion (URL parameter)',
|
932220: "Remote Command Execution: Unix Command Injection with pipe",
|
||||||
931110: 'RFI: common RFI vulnerable parameter name + off-domain URL',
|
932235: "Remote Command Execution: Unix Command Injection (command without evasion)",
|
||||||
931120: 'RFI: possible remote file inclusion (trailing question mark)',
|
932236: "Remote Command Execution: Unix Command Injection (command without evasion)",
|
||||||
931130: 'RFI: possible remote file inclusion (off-domain reference)',
|
932237: "Remote Command Execution: Unix Shell Code Found in REQUEST_HEADERS",
|
||||||
|
932238: "Remote Command Execution: Unix Shell Code Found in REQUEST_HEADERS",
|
||||||
// ── 932xxx RCE — remote code execution ───────────────────────────────
|
932239: "Remote Command Execution: Unix Command Injection found in user-agent or referer header",
|
||||||
932100: 'RCE: Unix command injection',
|
932240: "Remote Command Execution: Unix Command Injection evasion attempt detected",
|
||||||
932105: 'RCE: Unix command injection (2)',
|
932250: "Remote Command Execution: Direct Unix Command Execution",
|
||||||
932106: 'RCE: Unix command injection (3)',
|
932260: "Remote Command Execution: Direct Unix Command Execution",
|
||||||
932110: 'RCE: Windows command injection',
|
932270: "Remote Command Execution: Unix Shell Expression Found",
|
||||||
932115: 'RCE: Windows command injection (2)',
|
932300: "Remote Command Execution: SMTP Command Execution",
|
||||||
932120: 'RCE: Windows PowerShell command',
|
932301: "Remote Command Execution: SMTP Command Execution",
|
||||||
932130: 'RCE: Unix shell expression found',
|
932310: "Remote Command Execution: IMAP Command Execution",
|
||||||
932140: 'RCE: Windows FOR/IF command',
|
932311: "Remote Command Execution: IMAP Command Execution",
|
||||||
932150: 'RCE: Direct Unix command execution',
|
932320: "Remote Command Execution: POP3 Command Execution",
|
||||||
932160: 'RCE: Unix shell code found',
|
932321: "Remote Command Execution: POP3 Command Execution",
|
||||||
932170: 'RCE: Shellshock (CVE-2014-6271)',
|
932330: "Remote Command Execution: Unix shell history invocation",
|
||||||
932171: 'RCE: Shellshock (CVE-2014-6271, 2)',
|
932331: "Remote Command Execution: Unix shell history invocation",
|
||||||
932180: 'RCE: restricted file upload attempted',
|
932370: "Remote Command Execution: Windows Command Injection",
|
||||||
932190: 'RCE: generic code injection attempt',
|
932380: "Remote Command Execution: Windows Command Injection",
|
||||||
932200: 'RCE: Unix shell bypass technique',
|
933011: "PHP Injection Attack: PHP Open Tag Found",
|
||||||
932205: 'RCE: Unix shell bypass technique (2)',
|
933013: "PHP Injection Attack: Medium-Risk PHP Function Name Found",
|
||||||
932206: 'RCE: Unix shell bypass technique (3)',
|
933015: "PHP Injection Attack: Variables Found",
|
||||||
932210: 'RCE: Unix shell bypass via env variable',
|
933110: "PHP Injection Attack: PHP Script File Upload Found",
|
||||||
932220: 'RCE: Unix shell injection via backtick',
|
933111: "PHP Injection Attack: PHP Script File Upload Found",
|
||||||
932230: 'RCE: Unix shell bypass with extended glob',
|
933120: "PHP Injection Attack: Configuration Directive Found",
|
||||||
932235: 'RCE: Unix shell bypass (5)',
|
933130: "PHP Injection Attack: Variables Found",
|
||||||
932236: 'RCE: Unix shell bypass (6)',
|
933140: "PHP Injection Attack: I/O Stream Found",
|
||||||
932237: 'RCE: Unix shell bypass (7)',
|
933150: "PHP Injection Attack: High-Risk PHP Function Name Found",
|
||||||
932239: 'RCE: Unix shell bypass (8)',
|
933160: "PHP Injection Attack: High-Risk PHP Function Call Found",
|
||||||
932240: 'RCE: Unix shell expression (2)',
|
933161: "PHP Injection Attack: Low-Value PHP Function Call Found",
|
||||||
932250: 'RCE: Unix file read via redirection',
|
933170: "PHP Injection Attack: Serialized Object Injection",
|
||||||
932260: 'RCE: Unix command injection (9)',
|
933180: "PHP Injection Attack: Variable Function Call Found",
|
||||||
|
933190: "PHP Injection Attack: PHP Closing Tag Found",
|
||||||
// ── 933xxx PHP injection ───────────────────────────────────────────────
|
933200: "PHP Injection Attack: Wrapper scheme detected",
|
||||||
933100: 'PHP injection: PHP opening tag found',
|
933210: "PHP Injection Attack: Variable Function Call Found",
|
||||||
933110: 'PHP injection: PHP script file upload',
|
933211: "PHP Injection Attack: Variable Function Call Found",
|
||||||
933111: 'PHP injection: PHP script file upload (2)',
|
934011: "Node.js Injection Attack 1/2",
|
||||||
933120: 'PHP injection: PHP configuration directive',
|
934013: "Node.js Injection Attack 2/2",
|
||||||
933130: 'PHP injection: PHP variables found',
|
934110: "Possible Server Side Request Forgery (SSRF) Attack: Cloud provider metadata URL in Parameter",
|
||||||
933131: 'PHP injection: PHP variables found (2)',
|
934120: "Possible Server Side Request Forgery (SSRF) Attack: URL Parameter using IP Address",
|
||||||
933140: 'PHP injection: PHP I/O stream found',
|
934130: "JavaScript Prototype Pollution",
|
||||||
933150: 'PHP injection: high-risk PHP function name found',
|
934140: "Perl Injection Attack",
|
||||||
933151: 'PHP injection: medium-risk PHP function name found',
|
934150: "Ruby Injection Attack",
|
||||||
933160: 'PHP injection: high-risk PHP function call found',
|
934160: "Node.js DoS attack",
|
||||||
933161: 'PHP injection: low-risk PHP function call found',
|
934170: "PHP data scheme attack",
|
||||||
933170: 'PHP injection: PHP object injection',
|
941011: "XSS Attack Detected via libinjection",
|
||||||
933180: 'PHP injection: variable function call found',
|
941013: "XSS Attack Detected via libinjection",
|
||||||
933190: 'PHP injection: PHP closing tag found',
|
941110: "XSS Filter - Category 1: Script Tag Vector",
|
||||||
933200: 'PHP injection: wrapper scheme detected',
|
941120: "XSS Filter - Category 2: Event Handler Vector",
|
||||||
933210: 'PHP injection: variable function call found (2)',
|
941130: "XSS Filter - Category 3: Attribute Vector",
|
||||||
|
941140: "XSS Filter - Category 4: Javascript URI Vector",
|
||||||
// ── 934xxx Node.js injection ───────────────────────────────────────────
|
941150: "XSS Filter - Category 5: Disallowed HTML Attributes",
|
||||||
934100: 'Node.js injection: server-side request forgery attempt',
|
941160: "NoScript XSS InjectionChecker: HTML Injection",
|
||||||
|
941170: "NoScript XSS InjectionChecker: Attribute Injection",
|
||||||
// ── 941xxx XSS — cross-site scripting ─────────────────────────────────
|
941180: "Node-Validator Deny List Keywords",
|
||||||
941100: 'XSS: XSS attack detected via libinjection',
|
941181: "Node-Validator Deny List Keywords",
|
||||||
941101: 'XSS: XSS attack detected via libinjection (2)',
|
941190: "IE XSS Filters - Attack Detected",
|
||||||
941110: 'XSS: XSS filter — category 1 (script tag)',
|
941200: "IE XSS Filters - Attack Detected",
|
||||||
941120: 'XSS: XSS filter — category 2 (event handler)',
|
941210: "IE XSS Filters - Attack Detected",
|
||||||
941130: 'XSS: XSS filter — category 3 (attribute name)',
|
941220: "IE XSS Filters - Attack Detected",
|
||||||
941140: 'XSS: XSS filter — category 4 (javascript: URI)',
|
941230: "IE XSS Filters - Attack Detected",
|
||||||
941150: 'XSS: XSS filter — category 5 (disallowed HTML)',
|
941240: "IE XSS Filters - Attack Detected",
|
||||||
941160: 'XSS: NoScript XSS InjectionChecker — HTML injection',
|
941250: "IE XSS Filters - Attack Detected",
|
||||||
941170: 'XSS: NoScript XSS InjectionChecker — attribute injection',
|
941260: "IE XSS Filters - Attack Detected",
|
||||||
941180: 'XSS: Node-validator blocklist keywords',
|
941270: "IE XSS Filters - Attack Detected",
|
||||||
941190: 'XSS: IE XSS filters — attack detected (1)',
|
941280: "IE XSS Filters - Attack Detected",
|
||||||
941200: 'XSS: IE XSS filters — attack detected (2)',
|
941290: "IE XSS Filters - Attack Detected",
|
||||||
941210: 'XSS: IE XSS filters — attack detected (3)',
|
941300: "IE XSS Filters - Attack Detected",
|
||||||
941220: 'XSS: IE XSS filters — attack detected (4)',
|
941310: "US-ASCII Malformed Encoding XSS Filter - Attack Detected",
|
||||||
941230: 'XSS: IE XSS filters — attack detected (5)',
|
941320: "Possible XSS Attack Detected - HTML Tag Handler",
|
||||||
941240: 'XSS: IE XSS filters — attack detected (6)',
|
941330: "IE XSS Filters - Attack Detected",
|
||||||
941250: 'XSS: IE XSS filters — attack detected (7)',
|
941340: "IE XSS Filters - Attack Detected",
|
||||||
941260: 'XSS: IE XSS filters — attack detected (8)',
|
941350: "UTF-7 Encoding IE XSS - Attack Detected",
|
||||||
941270: 'XSS: IE XSS filters — attack detected (9)',
|
941360: "JSFuck / Hieroglyphy obfuscation detected",
|
||||||
941280: 'XSS: IE XSS filters — attack detected (10)',
|
941370: "JavaScript global variable found",
|
||||||
941290: 'XSS: IE XSS filters — attack detected (11)',
|
941380: "AngularJS client side template injection detected",
|
||||||
941300: 'XSS: IE XSS filters — attack detected (12)',
|
941390: "Javascript method detected",
|
||||||
941310: 'XSS: US-ASCII malformed encoding XSS filter',
|
941400: "XSS JavaScript function without parentheses",
|
||||||
941320: 'XSS: possible XSS attack — HTML tag handler',
|
942011: "SQL Injection Attack Detected via libinjection",
|
||||||
941330: 'XSS: IE XSS filters — attack detected (13)',
|
942013: "SQL Injection Attack: SQL Operator Detected",
|
||||||
941340: 'XSS: IE XSS filters — attack detected (14)',
|
942015: "Detects HAVING injections",
|
||||||
941350: 'XSS: UTF-7 encoding XSS — attack detected',
|
942017: "Restricted SQL Character Anomaly Detection (cookies): # of special characters exceeded (3)",
|
||||||
941360: 'XSS: JSFuck/Hieroglyphy obfuscated JavaScript',
|
942101: "SQL Injection Attack Detected via libinjection",
|
||||||
941370: 'XSS: JavaScript global variable found',
|
942130: "SQL Injection Attack: SQL Boolean-based attack detected",
|
||||||
941380: 'XSS: AngularJS client-side template injection',
|
942131: "SQL Injection Attack: SQL Boolean-based attack detected",
|
||||||
941390: 'XSS: XSS filter — category 10 (JS global variable)',
|
942140: "SQL Injection Attack: Common DB Names Detected",
|
||||||
|
942150: "SQL Injection Attack: SQL function name detected",
|
||||||
// ── 942xxx SQLi — SQL injection ────────────────────────────────────────
|
942151: "SQL Injection Attack: SQL function name detected",
|
||||||
942100: 'SQLi: SQL injection attack detected via libinjection',
|
942152: "SQL Injection Attack: SQL function name detected",
|
||||||
942101: 'SQLi: SQL injection attack detected via libinjection (2)',
|
942160: "Detects blind sqli tests using sleep() or benchmark()",
|
||||||
942110: 'SQLi: SQL injection attack: common injection testing detected',
|
942170: "Detects SQL benchmark and sleep injection attempts including conditional queries",
|
||||||
942120: 'SQLi: SQL injection attack: SQL operator detected',
|
942180: "Detects basic SQL authentication bypass attempts 1/3",
|
||||||
942130: 'SQLi: SQL injection attack: SQL tautology detected',
|
942190: "Detects MSSQL code execution and information gathering attempts",
|
||||||
942140: 'SQLi: SQL injection attack: common DB names detected',
|
942200: "Detects MySQL comment-/space-obfuscated injections and backtick termination",
|
||||||
942150: 'SQLi: SQL injection attack',
|
942210: "Detects chained SQL injection attempts 1/2",
|
||||||
942151: 'SQLi: SQL injection attack (2)',
|
942220: "Looking for integer overflow attacks, these are taken from skipfish, except 2.2.2250738585072011e-308 is the \\"magic...",
|
||||||
942152: 'SQLi: SQL injection attack (3)',
|
942230: "Detects conditional SQL injection attempts",
|
||||||
942160: 'SQLi: blind SQL injection test using sleep()/benchmark()',
|
942240: "Detects MySQL charset switch and MSSQL DoS attempts",
|
||||||
942170: 'SQLi: SQL benchmark and sleep injection attempts',
|
942250: "Detects MATCH AGAINST, MERGE and EXECUTE IMMEDIATE injections",
|
||||||
942180: 'SQLi: basic SQL authentication bypass (1)',
|
942260: "Detects basic SQL authentication bypass attempts 2/3",
|
||||||
942190: 'SQLi: SQL code execution and information gathering',
|
942270: "Looking for basic sql injection. Common attack string for mysql, oracle and others",
|
||||||
942200: 'SQLi: MySQL comment/space-obfuscated injections and backtick',
|
942280: "Detects Postgres pg_sleep injection, waitfor delay attacks and database shutdown attempts",
|
||||||
942210: 'SQLi: chained SQL injection (1)',
|
942290: "Finds basic MongoDB SQL injection attempts",
|
||||||
942220: 'SQLi: integer overflow attack',
|
942300: "Detects MySQL comments, conditions and ch(a)r injections",
|
||||||
942230: 'SQLi: conditional SQL injection attempts',
|
942310: "Detects chained SQL injection attempts 2/2",
|
||||||
942240: 'SQLi: MySQL charset switch and MSSQL DoS',
|
942320: "Detects MySQL and PostgreSQL stored procedure/function injections",
|
||||||
942250: 'SQLi: MATCH AGAINST, MERGE and EXECUTE IMMEDIATE injections',
|
942321: "Detects MySQL and PostgreSQL stored procedure/function injections",
|
||||||
942251: 'SQLi: HAVING injection',
|
942330: "Detects classic SQL injection probings 1/3",
|
||||||
942260: 'SQLi: basic SQL authentication bypass (2)',
|
942340: "Detects basic SQL authentication bypass attempts 3/3",
|
||||||
942270: 'SQLi: basic SQL injection — MySQL/Oracle/MSSQL',
|
942350: "Detects MySQL UDF injection and other data/structure manipulation attempts",
|
||||||
942280: 'SQLi: Postgres pg_sleep injection, waitfor delay',
|
942360: "Detects concatenated basic SQL injection and SQLLFI attempts",
|
||||||
942290: 'SQLi: MongoDB SQL injection attempt',
|
942361: "Detects basic SQL injection based on keyword alter or union",
|
||||||
942300: 'SQLi: MySQL comments, conditions and ch(a)r injections',
|
942362: "Detects concatenated basic SQL injection and SQLLFI attempts",
|
||||||
942310: 'SQLi: chained SQL injection (2)',
|
942370: "Detects classic SQL injection probings 2/3",
|
||||||
942320: 'SQLi: MySQL and PostgreSQL stored procedure injections',
|
942380: "SQL Injection Attack",
|
||||||
942330: 'SQLi: classic SQL injection probings detected (1)',
|
942390: "SQL Injection Attack",
|
||||||
942340: 'SQLi: basic SQL authentication bypass (3)',
|
942400: "SQL Injection Attack",
|
||||||
942350: 'SQLi: MySQL UDF injection and other data/structure manipulation',
|
942410: "SQL Injection Attack",
|
||||||
942360: 'SQLi: concatenated basic SQL injection and SQLLFI attacks',
|
942420: "Restricted SQL Character Anomaly Detection (cookies): # of special characters exceeded (8)",
|
||||||
942361: 'SQLi: basic SQL injection based on keyword ALTER or UNION',
|
942430: "Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (12)",
|
||||||
942370: 'SQLi: classic SQL injection probings detected (2)',
|
942431: "Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (6)",
|
||||||
942380: 'SQLi: SQL injection attack',
|
942432: "Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (2)",
|
||||||
942390: 'SQLi: SQL injection attack (2)',
|
942441: "SQL Comment Sequence Detected",
|
||||||
942400: 'SQLi: SQL injection attack (3)',
|
942450: "SQL Hex Encoding Identified",
|
||||||
942410: 'SQLi: SQL injection attack (4)',
|
942460: "Meta-Character Anomaly Detection Alert - Repetitive Non-Word Characters",
|
||||||
942420: 'SQLi: restricted SQL character anomaly detection (cookies)',
|
942470: "SQL Injection Attack",
|
||||||
942421: 'SQLi: restricted SQL character anomaly detection (cookies, 2)',
|
942480: "SQL Injection Attack",
|
||||||
942430: 'SQLi: restricted SQL character anomaly detection (args)',
|
942490: "Detects classic SQL injection probings 3/3",
|
||||||
942431: 'SQLi: restricted SQL character anomaly detection (args, 2)',
|
942500: "MySQL in-line comment detected",
|
||||||
942432: 'SQLi: restricted SQL character anomaly detection (args, 3)',
|
942510: "SQLi bypass attempt by ticks or backticks detected",
|
||||||
942440: 'SQLi: SQL comment sequence detected',
|
942511: "SQLi bypass attempt by ticks detected",
|
||||||
942450: 'SQLi: SQL hex encoding identified',
|
942520: "Detects basic SQL authentication bypass attempts 4.0/4",
|
||||||
942460: 'SQLi: meta-character anomaly detection alert',
|
942521: "Detects basic SQL authentication bypass attempts 4.1/4",
|
||||||
942470: 'SQLi: SQL injection attack (5)',
|
942522: "Detects basic SQL authentication bypass attempts 4.1/4",
|
||||||
942480: 'SQLi: SQL injection attack (6)',
|
942530: "SQLi query termination detected",
|
||||||
942490: 'SQLi: classic SQL injection probings detected (3)',
|
942540: "SQL Authentication bypass (split query)",
|
||||||
942500: 'SQLi: MySQL inline comment detected',
|
942550: "JSON-Based SQL Injection",
|
||||||
942510: 'SQLi: SQLi bypass attempt via ticks',
|
942560: "MySQL Scientific Notation payload detected",
|
||||||
942511: 'SQLi: SQLi bypass attempt using ticks (2)',
|
943011: "Possible Session Fixation Attack: Setting Cookie Values in HTML",
|
||||||
942520: 'SQLi: SQL injection attack (7)',
|
943110: "Possible Session Fixation Attack: SessionID Parameter Name with Off-Domain Referer",
|
||||||
942521: 'SQLi: SQL injection attack (8)',
|
943120: "Possible Session Fixation Attack: SessionID Parameter Name with No Referer",
|
||||||
942530: 'SQLi: SQL injection attack (9)',
|
944011: "Remote Command Execution: Suspicious Java class detected",
|
||||||
942540: 'SQLi: SQL injection attack (10)',
|
944013: "Potential Remote Command Execution: Log4j / Log4shell",
|
||||||
942550: 'SQLi: MySQL injection detected',
|
944015: "Base64 encoded string matched suspicious keyword",
|
||||||
|
944017: "Potential Remote Command Execution: Log4j / Log4shell",
|
||||||
// ── 943xxx Session fixation ────────────────────────────────────────────
|
944110: "Remote Command Execution: Java process spawn (CVE-2017-9805)",
|
||||||
943100: 'Session fixation: possible session fixation attack (cookie values)',
|
944120: "Remote Command Execution: Java serialization (CVE-2015-4852)",
|
||||||
943110: 'Session fixation: possible session fixation attack (referrer off-domain)',
|
944130: "Suspicious Java class detected",
|
||||||
943120: 'Session fixation: possible session fixation attack (no referrer)',
|
944140: "Java Injection Attack: Java Script File Upload Found",
|
||||||
|
944150: "Potential Remote Command Execution: Log4j / Log4shell",
|
||||||
// ── 944xxx Java attacks ────────────────────────────────────────────────
|
944200: "Magic bytes Detected, probable java serialization in use",
|
||||||
944100: 'Java: remote command execution via Apache Struts, Oracle WebLogic',
|
944210: "Magic bytes Detected Base64 Encoded, probable java serialization in use",
|
||||||
944110: 'Java: remote command execution via Java keywords',
|
944240: "Remote Command Execution: Java serialization (CVE-2015-4852)",
|
||||||
944120: 'Java: remote command execution — Java deserialization',
|
944250: "Remote Command Execution: Suspicious Java method detected",
|
||||||
944130: 'Java: suspicious Java class detected',
|
944260: "Remote Command Execution: Malicious class-loading payload",
|
||||||
944200: 'Java: magic bytes indicative of Java serialization',
|
949052: "Inbound Anomaly Score Exceeded in phase 1 (Total Score: %{TX.BLOCKING_INBOUND_ANOMALY_SCORE})",
|
||||||
944210: 'Java: Java serialization deserialization gadget (1)',
|
949110: "Inbound Anomaly Score Exceeded (Total Score: %{TX.BLOCKING_INBOUND_ANOMALY_SCORE})",
|
||||||
944240: 'Java: remote code execution — Java serialization',
|
950010: "Directory Listing",
|
||||||
944250: 'Java: restricted Java method detected',
|
950013: "The Application Returned a 500-Level Status Code",
|
||||||
|
950140: "CGI source code leakage",
|
||||||
// ── 949xxx Anomaly scoring ─────────────────────────────────────────────
|
951010: "Microsoft Access SQL Information Leakage",
|
||||||
949110: 'Anomaly score exceeded: inbound anomaly score (blocking)',
|
951120: "Oracle SQL Information Leakage",
|
||||||
949111: 'Anomaly score exceeded: inbound anomaly score (PL2)',
|
951130: "DB2 SQL Information Leakage",
|
||||||
|
951140: "EMC SQL Information Leakage",
|
||||||
// ── 950xxx–959xxx Data leakage (response) ─────────────────────────────
|
951150: "firebird SQL Information Leakage",
|
||||||
950100: 'Data leakage: server-side include attack',
|
951160: "Frontbase SQL Information Leakage",
|
||||||
950130: 'Data leakage: server-side include attack (2)',
|
951170: "hsqldb SQL Information Leakage",
|
||||||
951100: 'Data leakage: SQL error leakage — MySQL error string',
|
951180: "informix SQL Information Leakage",
|
||||||
951110: 'Data leakage: SQL error leakage — PostgreSQL error string',
|
951190: "ingres SQL Information Leakage",
|
||||||
951120: 'Data leakage: SQL error leakage — Oracle error string',
|
951200: "interbase SQL Information Leakage",
|
||||||
951130: 'Data leakage: SQL error leakage — MSSQL error string',
|
951210: "maxDB SQL Information Leakage",
|
||||||
951140: 'Data leakage: SQL error leakage — MSSQL error string (2)',
|
951220: "mssql SQL Information Leakage",
|
||||||
951150: 'Data leakage: SQL error leakage — MSSQL error string (3)',
|
951230: "mysql SQL Information Leakage",
|
||||||
951160: 'Data leakage: SQL error leakage — SQL syntax error string',
|
951240: "postgres SQL Information Leakage",
|
||||||
951170: 'Data leakage: SQL error leakage — JBoss error string',
|
951250: "sqlite SQL Information Leakage",
|
||||||
951180: 'Data leakage: SQL error leakage — Java/EJB error string',
|
951260: "Sybase SQL Information Leakage",
|
||||||
951190: 'Data leakage: SQL error leakage — Microsoft Access error string',
|
952010: "Java Source Code Leakage",
|
||||||
951200: 'Data leakage: SQL error leakage — Microsoft Access error string (2)',
|
952110: "Java Errors",
|
||||||
951210: 'Data leakage: SQL error leakage — Oracle error string (2)',
|
953010: "PHP Information Leakage",
|
||||||
951220: 'Data leakage: SQL error leakage — DB2 error string',
|
953013: "PHP Information Leakage",
|
||||||
951230: 'Data leakage: SQL error leakage — EMC error string',
|
953110: "PHP source code leakage",
|
||||||
951240: 'Data leakage: SQL error leakage — SAP ASE error string',
|
953120: "PHP source code leakage",
|
||||||
951250: 'Data leakage: SQL error leakage — Sybase error string',
|
954010: "Disclosure of IIS install location",
|
||||||
951260: 'Data leakage: SQL error leakage — Informix error string',
|
954110: "Application Availability Error",
|
||||||
952100: 'Data leakage: Unix shell error leakage',
|
954120: "IIS Information Leakage",
|
||||||
952110: 'Data leakage: Unix shell error leakage (2)',
|
954130: "IIS Information Leakage",
|
||||||
953100: 'Data leakage: PHP error leakage',
|
955010: "Web shell detected",
|
||||||
953110: 'Data leakage: PHP error leakage (2)',
|
955013: "webadmin.php file manager",
|
||||||
953120: 'Data leakage: PHP error leakage (3)',
|
955110: "r57 web shell",
|
||||||
954100: 'Data leakage: IIS information leakage',
|
955120: "WSO web shell",
|
||||||
954110: 'Data leakage: IIS information leakage (2)',
|
955130: "b4tm4n web shell",
|
||||||
954120: 'Data leakage: IIS information leakage (3)',
|
955140: "Mini Shell web shell",
|
||||||
954130: 'Data leakage: IIS information leakage (4)',
|
955150: "Ashiyane web shell",
|
||||||
|
955160: "Symlink_Sa web shell",
|
||||||
// ── 980xxx Correlation ─────────────────────────────────────────────────
|
955170: "CasuS web shell",
|
||||||
980130: 'Correlation: inbound + outbound anomaly score',
|
955180: "GRP WebShell",
|
||||||
|
955190: "NGHshell web shell",
|
||||||
|
955200: "SimAttacker web shell",
|
||||||
|
955210: "Unknown web shell",
|
||||||
|
955220: "lama\\",
|
||||||
|
955230: "lostDC web shell",
|
||||||
|
955240: "Unknown web shell",
|
||||||
|
955250: "Unknown web shell",
|
||||||
|
955260: "Ru24PostWebShell web shell",
|
||||||
|
955270: "s72 Shell web shell",
|
||||||
|
955280: "PhpSpy web shell",
|
||||||
|
955290: "g00nshell web shell",
|
||||||
|
955300: "PuNkHoLic shell web shell",
|
||||||
|
955310: "azrail web shell",
|
||||||
|
955320: "SmEvK_PaThAn Shell web shell",
|
||||||
|
955330: "Shell I web shell",
|
||||||
|
955340: "b374k m1n1 web shell",
|
||||||
|
959052: "Outbound Anomaly Score Exceeded in phase 3 (Total Score: %{tx.blocking_outbound_anomaly_score})",
|
||||||
|
959100: "Outbound Anomaly Score Exceeded (Total Score: %{tx.blocking_outbound_anomaly_score})",
|
||||||
|
980099: "Anomaly Scores: \\
|
||||||
|
(Inbound Scores: blocking=%{tx.blocking_inbound_anomaly_score}, detection=%{tx.detection_inbound_a...",
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
|
||||||
* Returns the description for a given rule ID, or a fallback if unknown.
|
|
||||||
*/
|
|
||||||
export function getRuleDescription(ruleId: number): string {
|
export function getRuleDescription(ruleId: number): string {
|
||||||
return CRS_RULES[ruleId] ?? `Rule ${ruleId} — no description available`
|
return CRS_RULES[ruleId] ?? `Rule ${ruleId} — see coreruleset.org for details`
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Returns the rule category name from the rule ID prefix.
|
|
||||||
*/
|
|
||||||
export function getRuleCategory(ruleId: number): string {
|
|
||||||
const prefix = Math.floor(ruleId / 100)
|
|
||||||
const categories: Record<number, string> = {
|
|
||||||
9000: 'CRS Setup', 9001: 'Initialization',
|
|
||||||
9031: 'Scanner', 9050: 'Protocol',
|
|
||||||
9100: 'IP Reputation', 9111: 'Method Enforcement',
|
|
||||||
9121: 'DoS Protection', 9131: 'Scanner Detection',
|
|
||||||
9201: 'Protocol Enforcement', 9211: 'HTTP Smuggling',
|
|
||||||
9221: 'File Upload',
|
|
||||||
9301: 'LFI', 9311: 'RFI', 9321: 'RCE',
|
|
||||||
9331: 'PHP Injection', 9341: 'Node.js Injection',
|
|
||||||
9411: 'XSS', 9421: 'SQL Injection',
|
|
||||||
9431: 'Session Fixation', 9441: 'Java Attack',
|
|
||||||
9491: 'Anomaly Score',
|
|
||||||
9501: 'Response — Data Leakage', 9511: 'Response — SQL Error',
|
|
||||||
9521: 'Response — Unix Shell', 9531: 'Response — PHP Error',
|
|
||||||
9541: 'Response — IIS Error', 9801: 'Correlation',
|
|
||||||
}
|
|
||||||
return categories[prefix] ?? `Category ${Math.floor(ruleId / 1000) * 1000}`
|
|
||||||
}
|
}
|
||||||
Reference in New Issue
Block a user