CME-904

WAF (Web Application Firewall)

Harden Application Unquantified evidence Preventive

Description

HTTP-layer filtering that inspects requests for injection, XSS, path traversal, and other OWASP Top 10 patterns. Can operate in blocking or detection mode with OWASP Core Rule Set.

CVSS Vector Impacts

Metric	Transition	Rationale
Attack Complexity (AC)	L → H	OWASP Core Rule Set signature matching detects and blocks known injection, XSS, path traversal, and protocol violation patterns at the HTTP request layer before they reach the application

CWE Relationships

CWE-79 CWE-89 CWE-94 CWE-78 CWE-22

Verification

Verify WAF is in enforcement mode with rules loaded and blocking common attack payloads

$ curl -s -o /dev/null -w '%{http_code}' 'http://<target>/?q=<script>alert(1)</script>'
# Expected: 403

Platform: any

$ curl -s -o /dev/null -w '%{http_code}' 'http://<target>/?id=1+UNION+SELECT+1,2,3--'
# Expected: 403

Platform: any

$ curl -s -o /dev/null -w '%{http_code}' 'http://<target>/../../etc/passwd'
# Expected: 403

Platform: any

$ apachectl -M 2>/dev/null | grep security
# Expected: security2_module

Platform: linux

Remediation

linux ModSecurity with OWASP CRS on Apache httpd


dnf install -y mod_security mod_security_crs
sed -i 's/^SecRuleEngine DetectionOnly/SecRuleEngine On/' /etc/httpd/conf.d/mod_security.conf
sed -i 's/setvar:tx.paranoia_level=1/setvar:tx.paranoia_level=2/' /etc/httpd/modsecurity.d/owasp-modsecurity-crs/crs-setup.conf
apachectl configtest && systemctl reload httpd

linux ModSecurity v3 with OWASP CRS on nginx


dnf install -y nginx-mod-modsecurity mod_security_crs
printf 'modsecurity on;\nmodsecurity_rules_file /etc/nginx/modsecurity.d/modsecurity.conf;\n' > /etc/nginx/conf.d/modsecurity.conf
sed -i 's/^SecRuleEngine DetectionOnly/SecRuleEngine On/' /etc/nginx/modsecurity.d/modsecurity.conf
nginx -t && systemctl reload nginx