From f0120b64f3490a6bdfa3791db60efedc95d7c234 Mon Sep 17 00:00:00 2001 From: Debian Date: Wed, 3 Jun 2026 11:43:07 +0200 Subject: [PATCH] =?UTF-8?q?feat(waf):=20CRS-Regel-Beschreibungen=20als=20T?= =?UTF-8?q?ooltip=20=E2=80=94=20v1.2.81?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ~250 CRS-Regeln (Setup, Scanner, Protocol, IP-Reputation, LFI, RFI, RCE, PHP/Node.js/Java Injection, XSS, SQLi, Session-Fixation, Data-Leakage). Rule-ID-Tag in Alerts-Tabelle + Ausnahmen-Liste zeigt Tooltip bei Hover. Co-Authored-By: Claude Sonnet 4.6 --- VERSION | 2 +- management-ui/src/pages/WAF/crsRules.ts | 351 ++++++++++++++++++++++++ management-ui/src/pages/WAF/index.tsx | 11 +- 3 files changed, 361 insertions(+), 3 deletions(-) create mode 100644 management-ui/src/pages/WAF/crsRules.ts diff --git a/VERSION b/VERSION index b09d96b..3a67429 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -1.2.80 +1.2.81 diff --git a/management-ui/src/pages/WAF/crsRules.ts b/management-ui/src/pages/WAF/crsRules.ts new file mode 100644 index 0000000..1192198 --- /dev/null +++ b/management-ui/src/pages/WAF/crsRules.ts @@ -0,0 +1,351 @@ +/** + * OWASP Core Rule Set (CRS) v4.x — rule descriptions. + * Source: https://coreruleset.org / CRS GitHub + * Static map: rule_id → short description (EN). + * New rules added per CRS release; update this file when upgrading CRS. + */ +export const CRS_RULES: Record = { + // ── 900xxx Setup ─────────────────────────────────────────────────────── + 900000: 'CRS: Set paranoia level', + 900001: 'CRS: Set anomaly thresholds', + 900110: 'CRS: Anomaly scoring threshold configuration', + 900200: 'CRS: Allowed HTTP versions', + 900220: 'CRS: Allowed request content types', + + // ── 901xxx Initialization ────────────────────────────────────────────── + 901001: 'CRS: Version check — unsupported CRS version', + 901100: 'CRS: Anomaly scoring initialization', + + // ── 903xxx / 905xxx Protocol enforcement ────────────────────────────── + 903100: 'Protocol enforcement: missing Host header', + 905100: 'Protocol enforcement: HTTP/0.9 request', + + // ── 910xxx IP reputation ─────────────────────────────────────────────── + 910100: 'IP reputation: client IP in GeoIP blocklist', + 910110: 'IP reputation: client IP in DNSBL blocklist', + 910120: 'IP reputation: Sqli/XSS IP reputation', + 910130: 'IP reputation: Spamhaus DROP list', + 910150: 'IP reputation: project Honeypot', + 910160: 'IP reputation: project Honeypot — comment spammer', + 910170: 'IP reputation: project Honeypot — suspicious IP', + 910180: 'IP reputation: known scanners/hacking tool IP', + + // ── 911xxx Method enforcement ────────────────────────────────────────── + 911100: 'Method not allowed for this resource', + + // ── 912xxx DoS / rate limiting ───────────────────────────────────────── + 912120: 'DoS: too many requests from single IP', + + // ── 913xxx Scanner detection ─────────────────────────────────────────── + 913100: 'Scanner: security scanner User-Agent detected', + 913101: 'Scanner: scripting/generic HTTP client User-Agent', + 913102: 'Scanner: web crawler/bot User-Agent', + 913110: 'Scanner: request header associated with security scanner', + 913120: 'Scanner: request filename/argument associated with scanner', + + // ── 920xxx Protocol enforcement (request) ───────────────────────────── + 920100: 'Protocol: invalid HTTP request line', + 920120: 'Protocol: attempted multipart/form-data bypass', + 920121: 'Protocol: attempted multipart/form-data bypass (2)', + 920130: 'Protocol: failed to parse request body', + 920140: 'Protocol: multipart request body failed strict validation', + 920160: 'Protocol: Content-Length HTTP header is not numeric', + 920170: 'Protocol: GET/HEAD request with body content', + 920171: 'Protocol: GET/HEAD request with Transfer-Encoding', + 920180: 'Protocol: POST request missing Content-Length or Transfer-Encoding', + 920181: 'Protocol: Content-Length and Transfer-Encoding headers present', + 920190: 'Protocol: range header contains an invalid last byte value', + 920200: 'Protocol: range header contains too many fields', + 920201: 'Protocol: range header contains too many fields for PDF request', + 920210: 'Protocol: multiple/conflicting connection header data', + 920220: 'Protocol: URL encoding abuse attack attempt', + 920230: 'Protocol: multiple URL encoding detected', + 920240: 'Protocol: URL encoding abuse in request headers', + 920250: 'Protocol: UTF8 encoding abuse attack attempt', + 920260: 'Protocol: Unicode full/half width abuse attack attempt', + 920270: 'Protocol: invalid character in request (null character)', + 920271: 'Protocol: invalid character in request (non-printable)', + 920272: 'Protocol: invalid character in request (outside printable ASCII)', + 920273: 'Protocol: invalid character in request (outside very strict range)', + 920274: 'Protocol: invalid character in request headers (outside very strict range)', + 920280: 'Protocol: request missing Host header', + 920290: 'Protocol: empty Host header', + 920300: 'Protocol: request missing Accept header', + 920310: 'Protocol: request has empty Accept header', + 920311: 'Protocol: request has empty Accept header (2)', + 920320: 'Protocol: request missing User-Agent header', + 920330: 'Protocol: empty User-Agent header', + 920340: 'Protocol: request with content but no Content-Type header', + 920341: 'Protocol: request with content requires Content-Type header', + 920350: 'Protocol: Host header is a numeric IP address', + 920360: 'Protocol: argument name too long', + 920370: 'Protocol: argument value too long', + 920380: 'Protocol: too many arguments in request', + 920390: 'Protocol: total arguments size exceeded', + 920400: 'Protocol: uploaded file too large', + 920410: 'Protocol: total uploaded files size too large', + 920420: 'Protocol: request content type is not allowed', + 920430: 'Protocol: HTTP protocol version not allowed', + 920440: 'Protocol: URL file extension restricted by policy', + 920450: 'Protocol: HTTP header is restricted by policy', + 920460: 'Protocol: abnormal escape character in request', + 920470: 'Protocol: illegal Content-Type header', + 920480: 'Protocol: request Content-Type charset restricted', + 920500: 'Protocol: attempt to access a backup or working file', + 920510: 'Protocol: file extension blocked for security reasons', + 920520: 'Protocol: missing or invalid "nonce" value in request', + + // ── 921xxx HTTP request smuggling ───────────────────────────────────── + 921100: 'Request smuggling: HTTP request smuggling attack', + 921110: 'Request smuggling: HTTP request smuggling in request headers', + 921120: 'Request smuggling: HTTP response splitting attack', + 921130: 'Request smuggling: HTTP response splitting attack (2)', + 921140: 'Request smuggling: HTTP header injection via headers', + 921150: 'Request smuggling: HTTP header injection via parameters (CR/LF)', + 921151: 'Request smuggling: HTTP header injection via parameters (CR/LF, 2)', + 921160: 'Request smuggling: HTTP splitting (CR/LF and header-name found)', + 921170: 'Request smuggling: HTTP parameter pollution', + 921180: 'Request smuggling: HTTP parameter pollution (matched var found)', + + // ── 922xxx File upload ───────────────────────────────────────────────── + 922100: 'File upload: multipart bypass in Content-Disposition', + 922110: 'File upload: multipart bypass in Content-Type', + 922120: 'File upload: filename contains null character', + 922130: 'File upload: filename contains newline', + + // ── 930xxx LFI — local file inclusion ───────────────────────────────── + 930100: 'LFI: path traversal attack (/../)', + 930110: 'LFI: path traversal attack (/../) with special chars', + 930120: 'LFI: OS file access attempt', + 930130: 'LFI: restricted file access attempt', + + // ── 931xxx RFI — remote file inclusion ─────────────────────────────── + 931100: 'RFI: possible remote file inclusion (URL parameter)', + 931110: 'RFI: common RFI vulnerable parameter name + off-domain URL', + 931120: 'RFI: possible remote file inclusion (trailing question mark)', + 931130: 'RFI: possible remote file inclusion (off-domain reference)', + + // ── 932xxx RCE — remote code execution ─────────────────────────────── + 932100: 'RCE: Unix command injection', + 932105: 'RCE: Unix command injection (2)', + 932106: 'RCE: Unix command injection (3)', + 932110: 'RCE: Windows command injection', + 932115: 'RCE: Windows command injection (2)', + 932120: 'RCE: Windows PowerShell command', + 932130: 'RCE: Unix shell expression found', + 932140: 'RCE: Windows FOR/IF command', + 932150: 'RCE: Direct Unix command execution', + 932160: 'RCE: Unix shell code found', + 932170: 'RCE: Shellshock (CVE-2014-6271)', + 932171: 'RCE: Shellshock (CVE-2014-6271, 2)', + 932180: 'RCE: restricted file upload attempted', + 932190: 'RCE: generic code injection attempt', + 932200: 'RCE: Unix shell bypass technique', + 932205: 'RCE: Unix shell bypass technique (2)', + 932206: 'RCE: Unix shell bypass technique (3)', + 932210: 'RCE: Unix shell bypass via env variable', + 932220: 'RCE: Unix shell injection via backtick', + 932230: 'RCE: Unix shell bypass with extended glob', + 932235: 'RCE: Unix shell bypass (5)', + 932236: 'RCE: Unix shell bypass (6)', + 932237: 'RCE: Unix shell bypass (7)', + 932239: 'RCE: Unix shell bypass (8)', + 932240: 'RCE: Unix shell expression (2)', + 932250: 'RCE: Unix file read via redirection', + 932260: 'RCE: Unix command injection (9)', + + // ── 933xxx PHP injection ─────────────────────────────────────────────── + 933100: 'PHP injection: PHP opening tag found', + 933110: 'PHP injection: PHP script file upload', + 933111: 'PHP injection: PHP script file upload (2)', + 933120: 'PHP injection: PHP configuration directive', + 933130: 'PHP injection: PHP variables found', + 933131: 'PHP injection: PHP variables found (2)', + 933140: 'PHP injection: PHP I/O stream found', + 933150: 'PHP injection: high-risk PHP function name found', + 933151: 'PHP injection: medium-risk PHP function name found', + 933160: 'PHP injection: high-risk PHP function call found', + 933161: 'PHP injection: low-risk PHP function call found', + 933170: 'PHP injection: PHP object injection', + 933180: 'PHP injection: variable function call found', + 933190: 'PHP injection: PHP closing tag found', + 933200: 'PHP injection: wrapper scheme detected', + 933210: 'PHP injection: variable function call found (2)', + + // ── 934xxx Node.js injection ─────────────────────────────────────────── + 934100: 'Node.js injection: server-side request forgery attempt', + + // ── 941xxx XSS — cross-site scripting ───────────────────────────────── + 941100: 'XSS: XSS attack detected via libinjection', + 941101: 'XSS: XSS attack detected via libinjection (2)', + 941110: 'XSS: XSS filter — category 1 (script tag)', + 941120: 'XSS: XSS filter — category 2 (event handler)', + 941130: 'XSS: XSS filter — category 3 (attribute name)', + 941140: 'XSS: XSS filter — category 4 (javascript: URI)', + 941150: 'XSS: XSS filter — category 5 (disallowed HTML)', + 941160: 'XSS: NoScript XSS InjectionChecker — HTML injection', + 941170: 'XSS: NoScript XSS InjectionChecker — attribute injection', + 941180: 'XSS: Node-validator blocklist keywords', + 941190: 'XSS: IE XSS filters — attack detected (1)', + 941200: 'XSS: IE XSS filters — attack detected (2)', + 941210: 'XSS: IE XSS filters — attack detected (3)', + 941220: 'XSS: IE XSS filters — attack detected (4)', + 941230: 'XSS: IE XSS filters — attack detected (5)', + 941240: 'XSS: IE XSS filters — attack detected (6)', + 941250: 'XSS: IE XSS filters — attack detected (7)', + 941260: 'XSS: IE XSS filters — attack detected (8)', + 941270: 'XSS: IE XSS filters — attack detected (9)', + 941280: 'XSS: IE XSS filters — attack detected (10)', + 941290: 'XSS: IE XSS filters — attack detected (11)', + 941300: 'XSS: IE XSS filters — attack detected (12)', + 941310: 'XSS: US-ASCII malformed encoding XSS filter', + 941320: 'XSS: possible XSS attack — HTML tag handler', + 941330: 'XSS: IE XSS filters — attack detected (13)', + 941340: 'XSS: IE XSS filters — attack detected (14)', + 941350: 'XSS: UTF-7 encoding XSS — attack detected', + 941360: 'XSS: JSFuck/Hieroglyphy obfuscated JavaScript', + 941370: 'XSS: JavaScript global variable found', + 941380: 'XSS: AngularJS client-side template injection', + 941390: 'XSS: XSS filter — category 10 (JS global variable)', + + // ── 942xxx SQLi — SQL injection ──────────────────────────────────────── + 942100: 'SQLi: SQL injection attack detected via libinjection', + 942101: 'SQLi: SQL injection attack detected via libinjection (2)', + 942110: 'SQLi: SQL injection attack: common injection testing detected', + 942120: 'SQLi: SQL injection attack: SQL operator detected', + 942130: 'SQLi: SQL injection attack: SQL tautology detected', + 942140: 'SQLi: SQL injection attack: common DB names detected', + 942150: 'SQLi: SQL injection attack', + 942151: 'SQLi: SQL injection attack (2)', + 942152: 'SQLi: SQL injection attack (3)', + 942160: 'SQLi: blind SQL injection test using sleep()/benchmark()', + 942170: 'SQLi: SQL benchmark and sleep injection attempts', + 942180: 'SQLi: basic SQL authentication bypass (1)', + 942190: 'SQLi: SQL code execution and information gathering', + 942200: 'SQLi: MySQL comment/space-obfuscated injections and backtick', + 942210: 'SQLi: chained SQL injection (1)', + 942220: 'SQLi: integer overflow attack', + 942230: 'SQLi: conditional SQL injection attempts', + 942240: 'SQLi: MySQL charset switch and MSSQL DoS', + 942250: 'SQLi: MATCH AGAINST, MERGE and EXECUTE IMMEDIATE injections', + 942251: 'SQLi: HAVING injection', + 942260: 'SQLi: basic SQL authentication bypass (2)', + 942270: 'SQLi: basic SQL injection — MySQL/Oracle/MSSQL', + 942280: 'SQLi: Postgres pg_sleep injection, waitfor delay', + 942290: 'SQLi: MongoDB SQL injection attempt', + 942300: 'SQLi: MySQL comments, conditions and ch(a)r injections', + 942310: 'SQLi: chained SQL injection (2)', + 942320: 'SQLi: MySQL and PostgreSQL stored procedure injections', + 942330: 'SQLi: classic SQL injection probings detected (1)', + 942340: 'SQLi: basic SQL authentication bypass (3)', + 942350: 'SQLi: MySQL UDF injection and other data/structure manipulation', + 942360: 'SQLi: concatenated basic SQL injection and SQLLFI attacks', + 942361: 'SQLi: basic SQL injection based on keyword ALTER or UNION', + 942370: 'SQLi: classic SQL injection probings detected (2)', + 942380: 'SQLi: SQL injection attack', + 942390: 'SQLi: SQL injection attack (2)', + 942400: 'SQLi: SQL injection attack (3)', + 942410: 'SQLi: SQL injection attack (4)', + 942420: 'SQLi: restricted SQL character anomaly detection (cookies)', + 942421: 'SQLi: restricted SQL character anomaly detection (cookies, 2)', + 942430: 'SQLi: restricted SQL character anomaly detection (args)', + 942431: 'SQLi: restricted SQL character anomaly detection (args, 2)', + 942432: 'SQLi: restricted SQL character anomaly detection (args, 3)', + 942440: 'SQLi: SQL comment sequence detected', + 942450: 'SQLi: SQL hex encoding identified', + 942460: 'SQLi: meta-character anomaly detection alert', + 942470: 'SQLi: SQL injection attack (5)', + 942480: 'SQLi: SQL injection attack (6)', + 942490: 'SQLi: classic SQL injection probings detected (3)', + 942500: 'SQLi: MySQL inline comment detected', + 942510: 'SQLi: SQLi bypass attempt via ticks', + 942511: 'SQLi: SQLi bypass attempt using ticks (2)', + 942520: 'SQLi: SQL injection attack (7)', + 942521: 'SQLi: SQL injection attack (8)', + 942530: 'SQLi: SQL injection attack (9)', + 942540: 'SQLi: SQL injection attack (10)', + 942550: 'SQLi: MySQL injection detected', + + // ── 943xxx Session fixation ──────────────────────────────────────────── + 943100: 'Session fixation: possible session fixation attack (cookie values)', + 943110: 'Session fixation: possible session fixation attack (referrer off-domain)', + 943120: 'Session fixation: possible session fixation attack (no referrer)', + + // ── 944xxx Java attacks ──────────────────────────────────────────────── + 944100: 'Java: remote command execution via Apache Struts, Oracle WebLogic', + 944110: 'Java: remote command execution via Java keywords', + 944120: 'Java: remote command execution — Java deserialization', + 944130: 'Java: suspicious Java class detected', + 944200: 'Java: magic bytes indicative of Java serialization', + 944210: 'Java: Java serialization deserialization gadget (1)', + 944240: 'Java: remote code execution — Java serialization', + 944250: 'Java: restricted Java method detected', + + // ── 949xxx Anomaly scoring ───────────────────────────────────────────── + 949110: 'Anomaly score exceeded: inbound anomaly score (blocking)', + 949111: 'Anomaly score exceeded: inbound anomaly score (PL2)', + + // ── 950xxx–959xxx Data leakage (response) ───────────────────────────── + 950100: 'Data leakage: server-side include attack', + 950130: 'Data leakage: server-side include attack (2)', + 951100: 'Data leakage: SQL error leakage — MySQL error string', + 951110: 'Data leakage: SQL error leakage — PostgreSQL error string', + 951120: 'Data leakage: SQL error leakage — Oracle error string', + 951130: 'Data leakage: SQL error leakage — MSSQL error string', + 951140: 'Data leakage: SQL error leakage — MSSQL error string (2)', + 951150: 'Data leakage: SQL error leakage — MSSQL error string (3)', + 951160: 'Data leakage: SQL error leakage — SQL syntax error string', + 951170: 'Data leakage: SQL error leakage — JBoss error string', + 951180: 'Data leakage: SQL error leakage — Java/EJB error string', + 951190: 'Data leakage: SQL error leakage — Microsoft Access error string', + 951200: 'Data leakage: SQL error leakage — Microsoft Access error string (2)', + 951210: 'Data leakage: SQL error leakage — Oracle error string (2)', + 951220: 'Data leakage: SQL error leakage — DB2 error string', + 951230: 'Data leakage: SQL error leakage — EMC error string', + 951240: 'Data leakage: SQL error leakage — SAP ASE error string', + 951250: 'Data leakage: SQL error leakage — Sybase error string', + 951260: 'Data leakage: SQL error leakage — Informix error string', + 952100: 'Data leakage: Unix shell error leakage', + 952110: 'Data leakage: Unix shell error leakage (2)', + 953100: 'Data leakage: PHP error leakage', + 953110: 'Data leakage: PHP error leakage (2)', + 953120: 'Data leakage: PHP error leakage (3)', + 954100: 'Data leakage: IIS information leakage', + 954110: 'Data leakage: IIS information leakage (2)', + 954120: 'Data leakage: IIS information leakage (3)', + 954130: 'Data leakage: IIS information leakage (4)', + + // ── 980xxx Correlation ───────────────────────────────────────────────── + 980130: 'Correlation: inbound + outbound anomaly score', +} + +/** + * Returns the description for a given rule ID, or a fallback if unknown. + */ +export function getRuleDescription(ruleId: number): string { + return CRS_RULES[ruleId] ?? `Rule ${ruleId} — no description available` +} + +/** + * Returns the rule category name from the rule ID prefix. + */ +export function getRuleCategory(ruleId: number): string { + const prefix = Math.floor(ruleId / 100) + const categories: Record = { + 9000: 'CRS Setup', 9001: 'Initialization', + 9031: 'Scanner', 9050: 'Protocol', + 9100: 'IP Reputation', 9111: 'Method Enforcement', + 9121: 'DoS Protection', 9131: 'Scanner Detection', + 9201: 'Protocol Enforcement', 9211: 'HTTP Smuggling', + 9221: 'File Upload', + 9301: 'LFI', 9311: 'RFI', 9321: 'RCE', + 9331: 'PHP Injection', 9341: 'Node.js Injection', + 9411: 'XSS', 9421: 'SQL Injection', + 9431: 'Session Fixation', 9441: 'Java Attack', + 9491: 'Anomaly Score', + 9501: 'Response — Data Leakage', 9511: 'Response — SQL Error', + 9521: 'Response — Unix Shell', 9531: 'Response — PHP Error', + 9541: 'Response — IIS Error', 9801: 'Correlation', + } + return categories[prefix] ?? `Category ${Math.floor(ruleId / 1000) * 1000}` +} diff --git a/management-ui/src/pages/WAF/index.tsx b/management-ui/src/pages/WAF/index.tsx index fa0f7d3..4f83338 100644 --- a/management-ui/src/pages/WAF/index.tsx +++ b/management-ui/src/pages/WAF/index.tsx @@ -14,6 +14,7 @@ import apiClient, { isEnvelope } from '../../api/client' import PageHeader from '../../components/PageHeader' import DataTable from '../../components/DataTable' import { useAuthStore } from '../../stores/auth' +import { getRuleDescription } from './crsRules' const { Text } = Typography @@ -201,7 +202,9 @@ function ConfigDrawer({ domainName, domainId, onClose }: ConfigDrawerProps) { padding: '6px 10px', background: '#F8FAFC', border: '1px solid #E2E8F0', borderRadius: 6, }}> - {ruleId} + + {ruleId} + {cfg?.exclusion_notes?.[ruleId] || {t('waf.config.noNote')}} @@ -371,7 +374,11 @@ function AlertsTab({ domainId }: { domainId?: number }) { { title: t('waf.alerts.col.uri'), dataIndex: 'uri', key: 'uri', ellipsis: true, render: (v: string) => {v} }, { title: t('waf.alerts.col.ruleId'), dataIndex: 'rule_id', key: 'rule_id', width: 90, - render: (v: number) => {v} }, + render: (v: number) => ( + + {v} + + ) }, { title: t('waf.alerts.col.severity'), dataIndex: 'severity', key: 'severity', width: 90, render: (v: string) => {v || '—'} }, { title: t('waf.alerts.col.msg'), dataIndex: 'rule_msg', key: 'rule_msg', ellipsis: true,