Difference between revisions of "WAF 330205"
m |
m |
||
| Line 11: | Line 11: | ||
This rule detects a known malicious attack tool. If your system is getting alerts on this rule your system is being attacked. This is not a false positive. | This rule detects a known malicious attack tool. If your system is getting alerts on this rule your system is being attacked. This is not a false positive. | ||
| − | The rule detects the "Bot for JCE" attack tool. This attack tool attacks vulnerable Joomla installations. | + | The rule detects the "Bot for JCE" attack tool. This attack tool attacks vulnerable Joomla installations that have a vulnerable version of the JCE Joomla Extension Remote File Upload installed. '''This bot attacks blindly.''' That means it just attacks the system ''without checking'' to see if Joomla is installed on the system and if a vulnerable JCE extension is installed. This means this attack tool also indiscriminately attacks systems that do not have Joomla installed. |
| − | If your system is being targeted with this tool we do not recommend you disable this rule, even if you do not have Joomla installed. This rule is telling you that someone is attacking your system, you should block this source. | + | If your system is being targeted with this tool we do not recommend you disable this rule, even if you do not have Joomla installed. This rule is telling you that someone is attacking your system, you should block this source. Please see the blog post referenced below for information about leaving rules enabled for applications you may not have installed. |
= Troubleshooting = | = Troubleshooting = | ||
Revision as of 13:11, 12 December 2013
| Rule 330205 | |
|---|---|
| Status | Active |
| Alert Message | Atomicorp.com WAF Rules: Joomla Exploit Bot |
Contents |
Description
This rule detects a known malicious attack tool. If your system is getting alerts on this rule your system is being attacked. This is not a false positive.
The rule detects the "Bot for JCE" attack tool. This attack tool attacks vulnerable Joomla installations that have a vulnerable version of the JCE Joomla Extension Remote File Upload installed. This bot attacks blindly. That means it just attacks the system without checking to see if Joomla is installed on the system and if a vulnerable JCE extension is installed. This means this attack tool also indiscriminately attacks systems that do not have Joomla installed.
If your system is being targeted with this tool we do not recommend you disable this rule, even if you do not have Joomla installed. This rule is telling you that someone is attacking your system, you should block this source. Please see the blog post referenced below for information about leaving rules enabled for applications you may not have installed.
Troubleshooting
False Positives
None. This rule detects a known malicious attack tool. If your system is getting alerts on this rule your system is being attacked. This is not a false positive.
Tuning Guidance
None. Do not disable this rule.
Additional Information
Blog Articles
Similar Rules
None.
Knowledge Base Articles
None.
Outside References
None.
