CRS Rule 920260
CRS detection rule by coreruleset · Apache-2.0
OWASP CRS (Official Repository)
SecRule REQUEST_URI|REQUEST_BODY "@rx (?i)%uff[0-9a-f]{2}" "id:920260, phase:2, block, t:none, msg:'Unicode Full/Half Width Abuse Attack Attempt', logdata:'%{MATCHED_VAR_NAME}=%{MATCHED_VAR}', tag:'application-multi', tag:'language-multi', tag:'platform-iis', tag:'platform-windows', tag:'attack-protocol', tag:'paranoia-level/1', tag:'OWASP_CRS', tag:'OWASP_CRS/PROTOCOL-ENFORCEMENT', tag:'capec/1000/255/153/267/72', ver:'OWASP_CRS/4.26.0-dev', severity:'WARNING', setvar:'tx.inbound_anomaly_score_pl1=+%{tx.warning_anomaly_score}'"
#
# Restrict type of characters sent
#
# This is a rule with multiple stricter siblings that grows more
# restrictive in higher paranoia levels.
#
# -=[ Rule Logic ]=-
# This rule uses the @validateByteRange operator to restrict the request
# payloads.
#
# -=[ Targets and ASCII Ranges ]=-
#
# 920270: PL1 : REQUEST_URI, REQUEST_HEADERS, ARGS and ARGS_NAMES
# ASCII 1-255 : Full ASCII range without null character
#
# 920271: PL2 : REQUEST_URI, REQUEST_HEADERS, ARGS and ARGS_NAMES
# ASCII 9,10,13,32-126,128-255 : Full visible ASCII range, tab, newline
#
# 920272: PL3 : REQUEST_URI, REQUEST_HEADERS, ARGS, ARGS_NAMES and REQUEST_BODY
# ASCII 32-36,38-126 : Visible lower ASCII range without percent symbol
#
# 920273: PL4 : ARGS, ARGS_NAMES and REQUEST_BODY
# ASCII 38,44-46,48-58,61,65-90,95,97-122
# A-Z a-z 0-9 = - _ . , : &
#
# 920274: PL4 : REQUEST_HEADERS without User-Agent, Referer, Cookie
# and Structured Header booleans
# ASCII 32,34,38,42-59,61,65-90,95,97-122
# A-Z a-z 0-9 = - _ . , : & " * + / SPACE
#
# REQUEST_URI and REQUEST_HEADERS User-Agent, Referer and Cookie are very hard
# to restrict beyond the limits in 920272. Structured Header booleans are
# validated separately in 920275.
#
# 920274 generally has few positives. However, it would detect rare attacks
# on Accept request headers and friends.