CME-904

WAF (Web Application Firewall)

Harden Application Unquantified evidence Preventive

Description

HTTP-layer filtering that inspects requests for injection, XSS, path traversal, and other OWASP Top 10 patterns. Can operate in blocking or detection mode with OWASP Core Rule Set.

CVSS Vector Impacts

Metric	Transition	Rationale
Attack Complexity (AC)	L → H	OWASP Core Rule Set signature matching detects and blocks known injection, XSS, path traversal, and protocol violation patterns at the HTTP request layer before they reach the application

CWE Relationships

CWE-79 CWE-89 CWE-94 CWE-78 CWE-22

Verification

Verify WAF is in enforcement mode with rules loaded and blocking common attack payloads

$ curl -s -o /dev/null -w '%{http_code}' 'http://<target>/?q=<script>alert(1)</script>'
# Expected: 403

Platform: any

$ curl -s -o /dev/null -w '%{http_code}' 'http://<target>/?id=1+UNION+SELECT+1,2,3--'
# Expected: 403

Platform: any

$ curl -s -o /dev/null -w '%{http_code}' 'http://<target>/../../etc/passwd'
# Expected: 403

Platform: any

$ apachectl -M 2>/dev/null | grep security
# Expected: security2_module

Platform: linux