WAF 397678

From Atomicorp Wiki
Jump to: navigation, search

Rule ID

397678

Status

Active rule currently published.

Alert Message

Atomicorp.com WAF Rules - Virtual Just In Time Patch: Access to unauthenticated BackupBuddy backup file. Not blocked.

Description

This rule detects if someone attempts to access a Backbuddy backup. Backupbuddy does not authenticate access requests to backups, and attackers can access a backup by either guessing the backup files name, which uses a standard format, or accessing the backups directory (if the server is so configured to allow access).

By default ASL does not block this action, it just alerts that it has occurred. If you wish to block this activity log into ASL and configure rule 64277 for active response.

False Positives

This rule blocks users from using BackupBuddy in an insecure manner. If you wish to allow your users to do this, disable this rule.

Tuning Guidance

If you you believe this is a false positive, please submit it to our support team. The process for submitting false positives is documented on the Reporting False Positives page.

Similar Rules

WAF_397679

Knowledge Base Articles

None.

Outside References

None.

Personal tools