fix(932): remove w from Unix no-arguments command list by zoutjebot · Pull Request #4592 · coreruleset/coreruleset

zoutjebot · 2026-03-30T08:13:47Z

What

Single letter 'w' (who-is-logged-on) causes excessive FPs. Related 'who' and 'whoami' remain for better signal.

Context

Part of CVE-derived payload research FP reductions. See tracking issue #4584 for full context.

github-actions · 2026-03-30T08:14:16Z

📊 Quantitative test results for language: eng, year: 2023, size: 10K, paranoia level: 1:
🚀 Quantitative testing did not detect new false positives

fzipi · 2026-03-30T12:28:04Z

@theseion What do you think about this one?

theseion · 2026-03-31T05:12:58Z

@theseion What do you think about this one?

Makes sense, we exclude w in the other PL1 rules as well. It might have been an oversight to not exclude it.

fzipi · 2026-04-08T01:06:36Z

ping @zoutjebot

EsadCetiner · 2026-04-15T09:22:18Z

@zoutjebot Can you add negative tests based on the false positives you encountered?

Add w to unix-shell-noarguments-fps-pl1.ra exclusion list instead of removing it from the main command list. This keeps w detected at PL2+ while preventing false positives at PL1 where ?w= is common in legitimate query parameters (width, weight, search terms). Addresses review feedback from theseion and EsadCetiner on PR coreruleset#4592. Changes: - Add w to regex-assembly/exclude/unix-shell-noarguments-fps-pl1.ra - Regenerate .conf via crs-toolchain - Add negative tests: ?w=value (GET), w=640 (POST form) - Add positive test: ;who still detected at PL1

zoutjebot · 2026-04-17T14:40:21Z

Addressed both review points:

@theseion — moved the change to the correct file. w is now added to regex-assembly/exclude/unix-shell-noarguments-fps-pl1.ra instead of being removed from the main command list. This keeps w detected at PL2+ while excluding it at PL1.

@EsadCetiner — added negative tests based on the false positive patterns:

?w=hello+world (GET query param, common for search/width)
w=640&h=480 (POST form data, dimension parameters)
Plus a positive test confirming who is still detected at PL1

Rebased on latest main and regenerated .conf via crs-toolchain.

EsadCetiner · 2026-04-18T01:14:18Z

@zoutjebot Looking at the tests, none of the false positive tests your adding are actually currently false positives.
curl -H "x-format-output: txt-matched-rules" https://sandbox.coreruleset.org -d 'w=640&h=480'

The PL-1 requires an evasion prefix before it blocks a command with no arguments

$ curl -H "x-format-output: txt-matched-rules" https://sandbox.coreruleset.org -d ';w=640&h=480'
932340 PL1 Remote Command Execution: Direct Unix Command Execution (No Arguments)
949110 PL? Inbound Anomaly Score Exceeded (Total Score: 5)
980170 PL? Anomaly Scores: (Inbound Scores: blocking=5, detection=5, per_pl=5-0-0-0, threshold=5) - (Outbound Scores: blocking=0, detection=0, per_pl=0-0-0-0, threshold=4) - (SQLI=0, XSS=0, RFI=0, LFI=0, RCE=5, PHPI=0, HTTP=0, SESS=0, COMBINED_SCORE=5)

Only at PL-3 are commands with no arguments blocked without an evasion prefix:

$ curl -H "x-format-output: txt-matched-rules" -H "x-crs-paranoia-level: 3" https://sandbox.coreruleset.org -d
 'w=640&h=480'
932350 PL3 Remote Command Execution: Direct Unix Command Execution (No Arguments)
949110 PL? Inbound Anomaly Score Exceeded (Total Score: 5)
980170 PL? Anomaly Scores: (Inbound Scores: blocking=5, detection=5, per_pl=0-0-5-0, threshold=5) - (Outbound Scores: blocking=0, detection=0, per_pl=0-0-0-0, threshold=4) - (SQLI=0, XSS=0, RFI=0, LFI=0, RCE=5, PHPI=0, HTTP=0, SESS=0, COMBINED_SCORE=5)

HackingRepo · 2026-04-19T20:03:38Z

i see all those FPs are not true

relunsec@relunsec:~$ curl -H "x-format-output: txt-matched-rules" https://sandbox.coreruleset.org -d 'w=640&h=480' -H "x-crs-paranoia-level: 2" -i
HTTP/1.1 405 Method Not Allowed
Date: Sun, 19 Apr 2026 20:02:15 GMT
Content-Type: text/plain; charset=iso-8859-1
Transfer-Encoding: chunked
Connection: keep-alive
X-Unique-ID: aeU0xzaTAovO3v6zz34g1gAAAA8
Allow: TRACE
x-backend: apache-v4-lts

^[[Arelunsec@relunsec:~$ curl -H "x-format-output: txt-matched-rules" https://sandbox.coreruleset.org/?w=640 -i
HTTP/1.1 200 OK
Date: Sun, 19 Apr 2026 20:02:28 GMT
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Unique-ID: aeU01MwsS20qcJ4UfDwXNQAAAMg
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' camo.githubusercontent.com
x-backend: apache-v4-lts

relunsec@relunsec:~$ curl -H "x-format-output: txt-matched-rules" https://sandbox.coreruleset.org/?query=w -i
HTTP/1.1 200 OK
Date: Sun, 19 Apr 2026 20:02:46 GMT
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Unique-ID: aeU05jaTAovO3v6zz34g1wAAABA
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' camo.githubusercontent.com
x-backend: apache-v4-lts

relunsec@relunsec:~$ curl -H "x-format-output: txt-matched-rules" https://sandbox.coreruleset.org/?error=wireless+password+invalid -i
HTTP/1.1 200 OK
Date: Sun, 19 Apr 2026 20:03:13 GMT
Content-Type: text/plain; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Unique-ID: aeU1ATaTAovO3v6zz34g2AAAABc
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' camo.githubusercontent.com
x-backend: apache-v4-lts

relunsec@relunsec:~$ 

relunsec@relunsec:~$ touch w
relunsec@relunsec:~$ curl -F "file_field=@w" https://sandbox.coreruleset.org/upload -i  -H "x-format-output: txt-matched-rules"
HTTP/1.1 404 Not Found
Date: Sun, 19 Apr 2026 20:07:55 GMT
Content-Type: text/plain; charset=iso-8859-1
Transfer-Encoding: chunked
Connection: keep-alive
X-Unique-ID: aeU2GzaTAovO3v6zz34g2gAAAAM
x-backend: apache-v4-lts

relunsec@relunsec:~$

on all FP fuzzing tests, that is allowed, only with ;w with is rarely to cause FP, that PR not need to be backported to LTS

fzipi · 2026-05-25T16:04:39Z

@zoutjebot Do you have some time to fix the tests as asked?

EsadCetiner · 2026-06-20T08:16:17Z

@zoutjebot Can you add a negative test which checks for a referer header containing https://example.com/?keyword=w?

We just had a report of a similar false positive in the CRS slack.

for more information, see https://pre-commit.ci

github-actions · 2026-07-21T10:50:13Z

📊 Quantitative test results for language: eng, year: 2023, size: 10K, paranoia level: 1:
🚀 Quantitative testing did not detect new false positives

EsadCetiner · 2026-07-21T10:51:00Z

I'm taking this PR over since the Author isn't around to respond to feedback.

azurit · 2026-07-21T14:01:22Z

Just got another FP from w, rule 932340 (browsing contacts in Horde/IMP webmail):
Matched Data: =W found within REQUEST_HEADERS:Referer: https://example.com/turba/browse.php?show=all&page=W

zoutjebot mentioned this pull request Mar 30, 2026

CVE-derived payload research: FP reductions and FN improvements #4584

Open

theseion requested changes Mar 31, 2026

View reviewed changes

Comment thread regex-assembly/include/unix-shell-noarguments.ra

fzipi mentioned this pull request Apr 6, 2026

Monthly Chat Agenda April 2026 (2026-04-06) #4606

Closed

zoutjebot force-pushed the fix/932-remove-w-noarguments branch from 77ae16e to 788f70e Compare April 17, 2026 14:40

theseion mentioned this pull request May 4, 2026

Monthly Chat Agenda May 2026 (2026-05-04) #4631

Closed

theseion mentioned this pull request Jun 1, 2026

Monthly Chat Agenda June 2026 (2026-06-01) #4646

Closed

theseion mentioned this pull request Jul 6, 2026

Monthly Chat Agenda July 2026 (2026-07-06) #4701

Open

EsadCetiner and others added 3 commits July 21, 2026 20:46

add extra test cases

16c1ee5

Merge branch 'main' into fix/932-remove-w-noarguments

1abc507

chore(formatting): auto fixes from pre-commit hooks

9f60401

for more information, see https://pre-commit.ci

EsadCetiner self-assigned this Jul 21, 2026

EsadCetiner requested review from a team and theseion July 21, 2026 10:51

azurit approved these changes Jul 21, 2026

View reviewed changes

theseion approved these changes Jul 22, 2026

View reviewed changes

theseion added this pull request to the merge queue Jul 22, 2026

Merged via the queue into coreruleset:main with commit 72b6797 Jul 22, 2026
8 checks passed

theseion added 🚀 enhancement New feature or request ➕ False Positive and removed 🚀 enhancement New feature or request labels Jul 22, 2026

Uh oh!

Uh oh!

Conversation

zoutjebot commented Mar 30, 2026

What

Context

Uh oh!

github-actions Bot commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fzipi commented Mar 30, 2026

Uh oh!

Uh oh!

theseion commented Mar 31, 2026

Uh oh!

fzipi commented Apr 8, 2026

Uh oh!

EsadCetiner commented Apr 15, 2026

Uh oh!

zoutjebot commented Apr 17, 2026

Uh oh!

EsadCetiner commented Apr 18, 2026

Uh oh!

HackingRepo commented Apr 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fzipi commented May 25, 2026

Uh oh!

EsadCetiner commented Jun 20, 2026

Uh oh!

github-actions Bot commented Jul 21, 2026

Uh oh!

EsadCetiner commented Jul 21, 2026

Uh oh!

azurit commented Jul 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

github-actions Bot commented Mar 30, 2026 •

edited

Loading

HackingRepo commented Apr 19, 2026 •

edited

Loading