coreruleset / coreruleset/coreruleset
Detect RCE in User-Agent header (was 932200)
Open
Nobody has claimed this yet.
:+1: Feature Request
v4 LTS
- Dominant language
- Python
- Stars
- 3.3k
- Forks
- 470
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 11
Description
Motivation
While adding coverage for the problems found in the BB, we added User-Agent and Referer as targets for our RCE rules. This was a bit too aggressive, resulting in a higher rate of false positives.
Related PR: are #3489.
Proposed solution
We need to come with new rule that target User-Agent header, by their nature of being more free-form than other headers.
Alternatives
- Re-add the header back to RCE rules, and try to solve false positives (we tried).
Additional context
- BB
- #3498
- Release v4.1
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file, test, or entry point is named. Review related PR #3489, issue #3498, and the BB context first; done means a User-Agent-specific RCE rule is defined while addressing the false positives that prompted its removal.
Written by the indexing model from the issue text.
Assessment
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100