External/patterns
1
0
Fork 0
mirror of https://github.com/fabriziosalmi/patterns.git synced 2025-12-17 17:55:48 +00:00
Code Issues Packages Projects Releases Wiki Activity
patterns/waf_patterns/apache/java.conf

38 lines
4.8 KiB
Plaintext
Raw Normal View History

Automated update: OWASP CRS to Caddy and Nginx WAF rules [Sat Dec 21 00:35:03 UTC 2024]
2024-12-21 00:35:03 +00:00
# Apache ModSecurity rules for JAVA
SecRuleEngine On
Update: [Tue Jan 7 00:27:08 UTC 2025]
2025-01-07 00:27:08 +00:00
SecRule REQUEST_URI "@lt 1" "id:1000,phase:1,deny,status:403,log,msg:'java attack detected'"
SecRule REQUEST_URI "@lt 1" "id:1001,phase:1,deny,status:403,log,msg:'java attack detected'"
SecRule REQUEST_URI "@rx java.lang.(?:runtime|processbuilder)" "id:1002,phase:1,deny,status:403,log,msg:'java attack detected'"
SecRule REQUEST_URI "@rx (?:runtime|processbuilder)" "id:1003,phase:1,deny,status:403,log,msg:'java attack detected'"
SecRule REQUEST_URI "@rx (?:unmarshaller|base64data|java.)" "id:1004,phase:1,deny,status:403,log,msg:'java attack detected'"
SecRule REQUEST_URI "@rx (?:clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder)" "id:1005,phase:1,deny,status:403,log,msg:'java attack detected'"
SecRule REQUEST_URI "@rx (?:runtime|processbuilder)" "id:1006,phase:1,deny,status:403,log,msg:'java attack detected'"
SecRule REQUEST_URI "@pmFromFile java-classes.data" "id:1007,phase:1,deny,status:403,log,msg:'java attack detected'"
SecRule REQUEST_URI "@rx .*.(?:jsp|jspx).*$" "id:1008,phase:1,deny,status:403,log,msg:'java attack detected'"
SecRule REQUEST_URI "@rx (?i)(?:$|$?)(?:{|&l(?:brace|cub);?)(?:[^}]{0,15}(?:$|$?)(?:{|&l(?:brace|cub);?)|jndi|ctx)" "id:1009,phase:1,deny,status:403,log,msg:'java attack detected'"
SecRule REQUEST_URI "@lt 2" "id:1010,phase:1,deny,status:403,log,msg:'java attack detected'"
SecRule REQUEST_URI "@lt 2" "id:1011,phase:1,deny,status:403,log,msg:'java attack detected'"
SecRule REQUEST_URI "@rx (?i)(?:$|$?)(?:{|&l(?:brace|cub);?)(?:[^}]*(?:$|$?)(?:{|&l(?:brace|cub);?)|jndi|ctx)" "id:1012,phase:1,deny,status:403,log,msg:'java attack detected'"
SecRule REQUEST_URI "@rx xacxedx00x05" "id:1013,phase:1,deny,status:403,log,msg:'java attack detected'"
SecRule REQUEST_URI "@rx (?:rO0ABQ|KztAAU|Cs7QAF)" "id:1014,phase:1,deny,status:403,log,msg:'java attack detected'"
SecRule REQUEST_URI "@rx (?:clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder)" "id:1015,phase:1,deny,status:403,log,msg:'java attack detected'"
SecRule REQUEST_URI "@rx javab.+(?:runtime|processbuilder)" "id:1016,phase:1,deny,status:403,log,msg:'java attack detected'"
SecRule REQUEST_URI "@rx (?:class.module.classLoader.resources.context.parent.pipeline|springframework.context.support.FileSystemXmlApplicationContext)" "id:1017,phase:1,deny,status:403,log,msg:'java attack detected'"
SecRule REQUEST_URI "@lt 3" "id:1018,phase:1,deny,status:403,log,msg:'java attack detected'"
SecRule REQUEST_URI "@lt 3" "id:1019,phase:1,deny,status:403,log,msg:'java attack detected'"
SecRule REQUEST_URI "@rx (?:cnVudGltZQ|HJ1bnRpbWU|BydW50aW1l|cHJvY2Vzc2J1aWxkZXI|HByb2Nlc3NidWlsZGVy|Bwcm9jZXNzYnVpbGRlcg|Y2xvbmV0cmFuc2Zvcm1lcg|GNsb25ldHJhbnNmb3JtZXI|BjbG9uZXRyYW5zZm9ybWVy|Zm9yY2xvc3VyZQ|GZvcmNsb3N1cmU|Bmb3JjbG9zdXJl|aW5zdGFudGlhdGVmYWN0b3J5|Gluc3RhbnRpYXRlZmFjdG9yeQ|BpbnN0YW50aWF0ZWZhY3Rvcnk|aW5zdGFudGlhdGV0cmFuc2Zvcm1lcg|Gluc3RhbnRpYXRldHJhbnNmb3JtZXI|BpbnN0YW50aWF0ZXRyYW5zZm9ybWVy|aW52b2tlcnRyYW5zZm9ybWVy|Gludm9rZXJ0cmFuc2Zvcm1lcg|BpbnZva2VydHJhbnNmb3JtZXI|cHJvdG90eXBlY2xvbmVmYWN0b3J5|HByb3RvdHlwZWNsb25lZmFjdG9yeQ|Bwcm90b3R5cGVjbG9uZWZhY3Rvcnk|cHJvdG90eXBlc2VyaWFsaXphdGlvbmZhY3Rvcnk|HByb3RvdHlwZXNlcmlhbGl6YXRpb25mYWN0b3J5|Bwcm90b3R5cGVzZXJpYWxpemF0aW9uZmFjdG9yeQ|d2hpbGVjbG9zdXJl|HdoaWxlY2xvc3VyZQ|B3aGlsZWNsb3N1cmU)" "id:1020,phase:1,deny,status:403,log,msg:'java attack detected'"
SecRule REQUEST_URI "@lt 4" "id:1021,phase:1,deny,status:403,log,msg:'java attack detected'"
SecRule REQUEST_URI "@lt 4" "id:1022,phase:1,deny,status:403,log,msg:'java attack detected'"
SecRule REQUEST_URI "@rx (?i)(?:$|$?)(?:{|&l(?:brace|cub);?)" "id:1023,phase:1,deny,status:403,log,msg:'java attack detected'"
SecRule REQUEST_URI "@lt 1" "id:1185,phase:1,deny,status:403,log,msg:'java attack detected'"
SecRule REQUEST_URI "@lt 1" "id:1186,phase:1,deny,status:403,log,msg:'java attack detected'"
SecRule REQUEST_URI "@pmFromFile java-code-leakages.data" "id:1187,phase:1,deny,status:403,log,msg:'java attack detected'"
SecRule REQUEST_URI "@pmFromFile java-errors.data" "id:1188,phase:1,deny,status:403,log,msg:'java attack detected'"
SecRule REQUEST_URI "@lt 2" "id:1189,phase:1,deny,status:403,log,msg:'java attack detected'"
SecRule REQUEST_URI "@lt 2" "id:1190,phase:1,deny,status:403,log,msg:'java attack detected'"
SecRule REQUEST_URI "@lt 3" "id:1191,phase:1,deny,status:403,log,msg:'java attack detected'"
SecRule REQUEST_URI "@lt 3" "id:1192,phase:1,deny,status:403,log,msg:'java attack detected'"
SecRule REQUEST_URI "@lt 4" "id:1193,phase:1,deny,status:403,log,msg:'java attack detected'"
SecRule REQUEST_URI "@lt 4" "id:1194,phase:1,deny,status:403,log,msg:'java attack detected'"
Reference in New Issue Copy Permalink