WAF 330205

From Atomicorp Wiki
Jump to: navigation, search
Rule 330205
Status Active
Alert Message Atomicorp.com WAF Rules: Joomla Exploit Bot

Contents

[edit] Description

This rule detects a known malicious attack tool. If your system is getting alerts on this rule your system is being attacked. This is not a false positive.

The rule detects the "Bot for JCE" attack tool. This attack tool identifies itself, which makes its very easy to detect, and means that there can not be a false positive for this rule. Only this attack bot identifies itself as "Bot for JCE". The bot attacks vulnerable Joomla installations that have a vulnerable version of the JCE Joomla Extension Remote File Upload installed. This bot attacks blindly. That means it just attacks the system without checking to see if Joomla is installed on the system and if a vulnerable JCE extension is installed. This means this attack tool also indiscriminately attacks systems that do not have Joomla installed.

If your system is being targeted with this tool we do not recommend you disable this rule, even if you do not have Joomla installed. This rule is telling you that someone is attacking your system, you should block this source. Please see the blog post referenced below for information about leaving rules enabled for applications you may not have installed.

[edit] Troubleshooting

[edit] False Positives

None. This rule detects a known malicious attack tool. If your system is getting alerts on this rule your system is being attacked. This is not a false positive.

[edit] Tuning Guidance

None. Do not disable this rule.

[edit] Additional Information

[edit] Blog Articles

Detection and Tripwires

[edit] Similar Rules

None.

[edit] Knowledge Base Articles

None.

[edit] Outside References

None.

[edit] Notes

Personal tools