{"id":"CVE-2022-42889","kind":"vulnerability","aliases":["CVE-2022-42889"],"related":[],"title":"Apache Commons Text: crafted input triggers dynamic property evaluation","description":"AWS Managed Rules changelog - AWS WAF, AWS Firewall Manager, AWS Shield Advanced, and AWS Shield network security director\n\nIntroducing a new console experience for AWS WAF\n\nYou can now use the updated experience to access AWS WAF functionality anywhere in the console. For more details, see Working with the console. \n\n# AWS Managed Rules changelog\n\nThis section lists changes to the AWS Managed Rules for AWS WAF since their release in November, 2019.\n\n###### Note\n\nThis changelog reports changes to the rules and rule groups in AWS Managed Rules for AWS WAF.\n\nFor the IP reputation rule groups, this changelog reports changes to the rules and rule group, and it reports significant changes to the sources of the IP address lists that the rules use. It does not report changes to the IP address lists themselves, due to the dynamic nature of those lists. If you have questions about the IP address lists, contact your account manager or open a case at \n\nAWS Support Center\n\n. \n\n| Rule group and rules | Description | Date |\n| --- | --- | --- |\n| PHP application managed rule group This release updates the following rules: `PHP2Shell_BODY_Extended` | Released static version 2.5 of this rule group. Improved the detection signatures for the PHP web runtime remote code execution vulnerabilities CVE-2026-109618 and CVE-2026-109619. | 2026-10-22 |\n| PHP application managed rule group This release updates the following rules: `PHP2Shell_BODY_Extended` | Released static version 2.4 of this rule group. The new `PHP2Shell_BODY_Extended` rule adds detection for requests that match the PHP web runtime remote code execution vulnerability CVE-2026-109618. For more information, see NIST: National Vulnerability Database: CVE-2026-109618. This rule group now detects CVE-2026-109618 directly. This supersedes the guidance in the version 2.3 entry, which directed you to the `SizeRestrictions_BODY` rule in the AWS WAF Core rule set (CRS) managed rule group. | 2026-10-22 |\n| PHP application managed rule group This release updates the following rules: `PHP2Shell_BODY` | Released static version 2.3 of this rule group. The new `PHP2Shell_BODY` rule adds detection for requests that match the PHP web runtime remote code execution vulnerability CVE-2026-109619. For more information, see NIST: National Vulnerability Database: CVE-2026-109619. For CVE-2026-109618, the `SizeRestrictions_BODY` rule in the AWS WAF Core rule set (CRS) managed rule group adds protection by blocking request bodies that are over 8 KB (8,192 bytes). | 2026-10-21 |\n| AWS WAF Bot Control rule group | Released static version 7.0 of this rule group. Added token provenance labels at the targeted protection level. These labels flag a change in the category of IP address between the request that acquired an AWS WAF token and the request that presents it. Added device ID labels at the targeted protection level. These labels come from the device ID that the AWS WAF Android SDK collects. Added the cloud service provider label `awswaf:managed:aws:bot-control:signal:cloud_service_provider:fastly`. For more information, see Bot Control labels. | 2026-10-15 |\n| SQL database managed rule group This release updates the following rules: `SQLi_BODY` `SQLiExtendedPatterns_QUERYARGUMENTS` `SQLiExtendedPatterns_BODY` `SQLiExtendedPatterns_HEADER` `SQLiExtendedPatterns_URIPATH` | Released static version 2.5 of this rule group. Updated the `SQLi_BODY` rule and all `SQLiExtendedPatterns` rules to reduce false positives and improve detection. | 2026-09-16 |\n| Core rule set (CRS) managed rule group This release updates the following rules: `CrossSiteScripting_BODY` `CrossSiteScripting_COOKIE` `CrossSiteScripting_QUERYARGUMENTS` `CrossSiteScripting_URIPATH` | Released static version 1.23 of this rule group. Improved detection signatures for the cross site scripting rules. | 2026-08-28 |\n| SQL database managed rule group This release updates the following rules: `SQLi_COOKIE` `SQLi_URIPATH` `SQLi_QUERYARGUMENTS` `SQLi_BODY` `SQLiExtendedPatterns_QUERYARGUMENTS` `SQLiExtendedPatterns_BODY` `SQLiExtendedPatterns_HEADER` `SQLiExtendedPatterns_URIPATH` | Released static version 2.4 of this rule group. This release updates all rules to improve SQL injection detection logic. | 2026-08-12 |\n| AWS WAF Bot Control rule group | Released static version 6.1 of this rule group. Added new bot detection signatures across multiple categories, including Advertising, AI, Content Fetcher, Scraping Framework, Search Engine, Security, SEO, and Social Media. | 2026-07-24 |\n| Core rule set (CRS) managed rule group `GenericLFI_QUERYARGUMENTS` `GenericLFI_URIPATH` `GenericLFI_BODY` | Released static version 1.22 of this rule group. Improved detection signatures for the generic LFI rules. | 2026-07-20 |\n| Known bad inputs managed rule group `ReactJSRCE_BODY` | Released static version 1.26 of this rule group. Added the `REMOVE_NULLS` text transformation to the listed rule. | 2026-07-15 |\n| Windows operating system managed rule group `WindowsShellCommands_HEADER` `WindowsShellCommands_URIPATH` `WindowsShellCommands_BODY` `WindowsShellCommands_QUERYARGUMENTS` `WindowsShellCommands_QUERYSTRING` | Released static version 2.5 of this rule group. Removed `WindowsShellCommands_QUERYARGUMENTS` and replaced it with `WindowsShellCommands_QUERYSTRING`. Updated WindowsShellCommands rules to improve detection logic. | 2026-06-01 |\n| AWS WAF Bot Control rule group | Released static version 6.0 of this rule group. Added new bot detection signatures across multiple categories, including Advertising, Content Fetcher, and Search Engine. Expanded Web Bot Auth support to commercial partition regional AWS WAF integrations. Changed the behavior of Web Bot Auth verified bots to be treated as standard verified bots for all categories, not only the AI category. This static version does not change the default version behavior. | 2026-05-22 |\n| SQL database managed rule group `SQLi_COOKIE` `SQLi_URIPATH` `SQLi_QUERYARGUMENTS` `SQLi_BODY` `SQLiExtendedPatterns_QUERYARGUMENTS` `SQLiExtendedPatterns_BODY` `SQLiExtendedPatterns_HEADER` `SQLiExtendedPatterns_URIPATH` | Released static version 2.3 of this rule group. Added new rules `SQLiExtendedPatterns_HEADER` and `SQLiExtendedPatterns_URIPATH`. Added `REPLACE_COMMENTS` text transformations to all rules. Added `JS_DECODE` text transformations to `SQLi_COOKIE`, `SQLi_URIPATH`, and to all the new rules. Updated all the rules to improve detection logic. Version_2.3 is the successor to Version_1.3, not Version_2.0. These are separate lineages with different detection trade-offs. Customers relying on Version_2.0 detection behavior should pin that version explicitly. | 2026-04-29 |\n| Windows operating system managed rule group `WindowsShellCommands_HEADER` `WindowsShellCommands_COOKIE` `WindowsShellCommands_URIPATH` `WindowsShellCommands_BODY` `WindowsShellCommands_QUERYARGUMENTS` | Released static version 2.4 of this rule group. Removed `WindowsShellCommands_COOKIE` and replaced it with `WindowsShellCommands_HEADER` which matches on all headers. Added new rule `WindowsShellCommands_URIPATH`. Added JSON body inspection to the `WindowsShellCommands_BODY`. Added double `URL_DECODE_UNI` and `JS_DECODE` text transformations to the WindowsShellCommands rules. Updated WindowsShellCommands rules to reduce false positives. | 2026-04-28 |\n| Core rule set (CRS) managed rule group `RestrictedExtensions_QUERYARGUMENTS` `RestrictedExtensions_URIPATH` | Released static version 1.21 of this rule group. Improved detection signatures for these rules. | 2026-04-06 |\n| PHP application managed rule group `PHPHighRiskMethodsVariables_BODY` `PHPHighRiskMethodsVariables_QUERYSTRING` `PHPHighRiskMethodsVariables_HEADER` `PHPHighRiskMethodsVariables_URIPATH` | Released static version 2.2 of this rule group. Improved detections and added `PHPHighRiskMethodsVariables_URIPATH` rule. | 2026-03-24 |\n| AWS WAF Bot Control rule group New rules: `CategoryPagePreview` `CategoryWebhooks` | Released static version 5.0 of this rule group. Added 400+ new bots across multiple categories, including two new bot categories with their respective rules: Page Preview and Webhooks. Key Improvements Improved accuracy of bot detection signals and generic bot pattern matching, resulting in more precise traffic classification. This update changes how the managed rule group prioritizes bot detection. Specific unverified bot patterns are now evaluated before generic patterns and detection signals. This means that requests are more likely to be classified based on their most specific characteristics rather than generic indicators. What this means for your traffic: Generic bot pattern will now match less frequently. These patterns only apply when no more specific bot rule has already identified the traffic. This reduces over-classification and ensures that requests are labeled with the most accurate bot identification available. Detection signals such as indicators that a request originates from a cloud service provider, known bot data center, or uses a non-browser user agent, are now applied after bot identification rules. This ensures that specific bot classifications take precedence over generic traffic signals. Impact: You may see fewer labels for generic bot patterns in your traffic logs, as requests are now more accurately classified by specific bot rules. This provides clearer insight into the actual nature of your automated traffic and reduces noise from overly broad pattern matching. Unverified bot classifications will be more prominent and accurate, helping you better understand and manage automated requests to your applications. Note: This version includes the `awswaf:managed:aws:bot-control:bot:web_bot_auth` labels and rules updates from Version_4.0, but the `Web\n Bot Auth` functionality is still only available in CloudFront. | 2026-02-25 |\n| POSIX operating system managed rule group | Released static version 3.2 of this rule group. Improved detection signatures for all the rules. | 2026-01-15 |\n| Known bad inputs managed rule group `ReactJSRCE_BODY` | Released static version 1.25 of this rule group. Updated the `ReactJSRCE_BODY` to improve detection. | 2025-12-08 |\n| POSIX operating system managed rule group | Released static version 3.1 of this rule group. Improved detection signatures for all the rules. | 2025-12-08 |\n| Known bad inputs managed rule group `ReactJSRCE_BODY` | Released static version 1.24 of this rule group. Updated the `ReactJSRCE_BODY` to improve detection. | 2025-12-04 |\n| AWS WAF Bot Control rule group New labels: `awswaf:managed:aws:bot-control:bot:web_bot_auth ` `verified` – Successful verification `invalid` – Failed verification attempt `expired` –Expired key usage `unknown_bot` – Unrecognized key usage `awswaf:managed:aws:bot-control:bot:vendor<vendor_name>` – Bot vendor or operator `awswaf:managed:aws:bot-control:bot:name<rfc_name>` – Bot name (RFC token from WBA) `awswaf:managed:aws:bot-control:bot:account ` – AWS account identifier. (Amazon Bedrock Agent Core agents only) Scope: CloudFront | Deployed new static version `AWSManagedRulesBotControlRuleSet` Version_4.0 with Web Bot Authentication (WBA) support for cryptographic bot verification. This version must be explicitly selected and does not automatically update existing deployments using the default version. New capabilities: Web Bot Authentication (WBA) cryptographic verification for AI bots and agents Automatic allowlisting of verified WBA bots in Category AI rule Enhanced bot identification with vendor, name, and account labels Support for Amazon Bedrock Agent Core bot detection Rule updates: `Category AI `(Action: Block) Update to not match requests with `web_bot_auth:verified ` label. Verified WBA bots are automatically allowed `TGT_TokenAbsent` (Action: Count) Updated to not match requests with `web_bot_auth:verified` label Important Version_4.0 is a static version only – it does not change the default version behavior. To use WBA ","summary":"Apache Commons Text, a Java library, performs variable interpolation that dynamically evaluates and expands properties in text. The sources rate this critical (CVSS 9.8) but do not describe the full impact or attack conditions.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"apache commons text","fixed":["1.10.0"],"affected":">= 1.5, < 1.10.0","ecosystem":"vendor"},{"name":"netapp bluexp","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"juniper security threat response manager","fixed":["7.5.0"],"affected":"< 7.5.0","ecosystem":"vendor"},{"name":"juniper security threat response manager","fixed":[],"affected":"= 7.5.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apache-commons-text","aws","java","juniper-strm","lab-disclosure","maven","netapp-bluexp","package"],"not_affected_if":["commons-text-1.10.0-or-later","commons-text-below-1.5"],"how_to_check":"- Look for `commons-text` in Java dependency files (pom.xml, build.gradle, lock files) and check whether the version is at least `1.5` and below `1.10.0`.\n- Check vendor products listed as affected (Juniper Security Threat Response Manager below `7.5.0`) against their release notes; NetApp BlueXP status is unknown.","fix":"- Upgrade Apache Commons Text to `1.10.0` or later.\n- Juniper Security Threat Response Manager: move to `7.5.0`, per the sources.\n- NetApp BlueXP: unknown; check the vendor advisory.","status":"open","published_at":"2022-10-13T13:15:10+00:00","first_seen_at":"2026-10-24T17:33:06+00:00","triaged_at":"2026-10-25T05:29:21+00:00","updated_at":"2026-10-25T05:29:21+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T05:29:21Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Commons Text to `1.10.0` or later.\n- Juniper Security Threat Response Manager: move to `7.5.0`, per the sources.\n- NetApp BlueXP: unknown; check the vendor advisory.","reach":"unknown","title":"Apache Commons Text: crafted input triggers dynamic property evaluation","impact":"high","summary":"Apache Commons Text, a Java library, performs variable interpolation that dynamically evaluates and expands properties in text. The sources rate this critical (CVSS 9.8) but do not describe the full impact or attack conditions.","category":"package","nicknames":[],"who_cares":["java","maven","apache-commons-text","juniper-strm","netapp-bluexp"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Crafted input is dynamically evaluated; full impact not stated","analyst_note":"Lab source is an AWS WAF managed-rules changelog that does not cover this CVE; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2022-42889 for attack conditions and the Apache Commons Text advisory for exploitability and default-config details.","how_to_check":"- Look for `commons-text` in Java dependency files (pom.xml, build.gradle, lock files) and check whether the version is at least `1.5` and below `1.10.0`.\n- Check vendor products listed as affected (Juniper Security Threat Response Manager below `7.5.0`) against their release notes; NetApp BlueXP status is unknown.","needs_analyst":true,"not_affected_if":["commons-text-below-1.5","commons-text-1.10.0-or-later"],"who_is_affected":"Teams whose Java applications depend on Apache Commons Text versions from 1.5 up to but not including 1.10.0, including through transitive dependencies, and who pass untrusted input into its interpolation features. Teams on 1.10.0 or later, or with no Commons Text dependency, can skip it. The sources do not say which default configurations or input paths are exploitable.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.001923,"input_tokens":8114,"output_tokens":2223,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-08':668C '-09':627C '-10':294C,390C,480C,579C '-109618':288C,340C,351C,359C,449C '-109619':292C,434C,445C '-15':580C '-16':628C '-2022':11A,14A '-2026':287C,291C,339C,350C,358C,433C,444C,448C '-21':481C '-22':295C,391C '-28':669C '-42889':12A,15A '1.23':653C '192':477C '2.3':368C,408C '2.4':313C '2.5':268C,605C '2019':153C '2026':293C,389C,479C,578C,626C,667C '7.0':491C '8':474C,476C '9.8':71B 'access':116C 'account':235C 'acquir':520C 'add':324C,418C,465C,496C,531C,554C 'address':199C,213C,231C,515C 'advanc':93C 'android':551C 'anywher':120C 'apach':1A,32B,48B 'apache':16A 'apache-commons-text':31B 'applic':252C,297C,393C 'attack':80B 'aw':35B,82C,86C,88C,91C,95C,106C,117C,132C,142C,146C,166C,170C,242C,380C,456C,482C,522C,549C,562C 'awswaf':560C 'block':468C 'bluexp':20A,46B 'bodi':263C,308C,321C,376C,404C,416C,452C,470C,593C,597C,613C,643C,688C 'bot':484C,564C,575C 'bot-control':563C 'byte':478C 'case':240C 'categori':512C 'center':244C 'chang':139C,158C,181C,192C,209C,509C 'changelog':85C,135C,156C,179C 'cloud':556C,567C 'code':283C,335C,429C 'collect':553C 'come':542C 'common':2A,33B,49B 'commons':17A 'condit':81B 'consol':103C,123C,131C 'contact':233C 'control':485C,565C,576C 'cooki':645C,682C 'core':382C,458C,629C 'craft':4A 'critic':69B 'cross':663C 'crosssitescript':642C,644C,646C,648C 'crs':385C,461C,632C 'cve':10A,13A,286C,290C,338C,349C,357C,432C,443C,447C 'cvss':70B 'databas':348C,442C,582C,671C 'date':250C 'describ':75B 'descript':249C 'detail':126C 'detect':275C,325C,356C,419C,625C,659C 'devic':532C,545C 'direct':360C,371C 'director':99C 'disclosur':42B 'due':216C 'dynam':7A,58B,219C 'entri':369C 'evalu':9A,59B 'execut':284C,336C,430C 'expand':61B 'experi':104C,114C 'extend':264C,309C,322C 'fals':621C 'fast':570C 'firewal':89C 'flag':507C 'follow':260C,305C,401C,590C,640C,679C 'full':77B 'function':119C 'group':164C,177C,187C,246C,255C,272C,300C,317C,354C,388C,396C,412C,464C,487C,495C,585C,609C,635C,657C,674C 'guidanc':364C 'header':599C 'id':533C,546C 'impact':78B 'improv':273C,624C,658C 'inform':343C,437C,573C 'input':5A 'interpol':56B 'introduc':100C 'ip':174C,198C,212C,230C,514C 'java':36B,52B 'junip':38B 'juniper':21A,26A 'juniper-strm':37B 'kb':475C 'lab':41B 'lab-disclosur':40B 'label':499C,506C,534C,541C,559C,577C 'level':504C,539C 'librari':53B 'list':138C,200C,214C,223C,232C 'manag':83C,90C,133C,143C,167C,236C,253C,298C,386C,394C,462C,561C,583C,633C,672C 'manager':25A,30A 'match':329C,423C 'maven':43B 'nation':346C,440C 'natur':220C 'netapp':19A,45B 'netapp-bluexp':44B 'network':97C 'new':102C,319C,414C 'nist':345C,439C 'note':154C 'novemb':152C 'open':238C 'packag':47B 'perform':54B 'php':251C,279C,296C,331C,392C,425C 'php2shell':262C,307C,320C,403C,415C 'posit':622C 'present':529C 'properti':8A,62B 'protect':466C,503C,538C 'proven':498C 'provid':558C,569C 'queryargu':595C,647C,686C 'question':227C 'rate':67B 'reduc':620C 'releas':150C,257C,265C,302C,310C,398C,405C,488C,587C,602C,637C,650C,676C 'remot':282C,334C,428C 'report':157C,180C,190C,208C 'reput':175C 'request':327C,421C,469C,518C,527C 'response':24A,29A 'rule':84C,134C,144C,161C,163C,168C,176C,184C,186C,203C,245C,248C,254C,261C,271C,299C,306C,316C,323C,353C,377C,383C,387C,395C,402C,411C,417C,453C,459C,463C,486C,494C,584C,591C,608C,614C,618C,630C,634C,641C,656C,666C,673C,680C 'runtim':281C,333C,427C 'script':665C 'sdk':552C 'section':137C 'secur':98C 'security':22A,27A 'see':127C,344C,438C,574C 'servic':557C,568C 'set':384C,460C,631C 'shield':92C,96C 'signal':566C 'signatur':276C,660C 'signific':191C 'sinc':148C 'site':664C 'sizerestrict':375C,451C 'sourc':66B,195C 'sql':581C,670C 'sqli':592C,612C,681C,683C,685C,687C 'sqliextendedpattern':594C,596C,598C,600C,617C 'static':266C,311C,406C,489C,603C,651C 'strm':39B 'supersed':362C 'support':243C 'target':502C,537C 'text':3A,18A,34B,50B,64B 'threat':23A,28A 'token':497C,524C 'trigger':6A 'updat':113C,258C,303C,399C,588C,610C,638C,677C 'uripath':601C,649C,684C 'use':111C,204C 'variabl':55B 'version':267C,312C,367C,407C,490C,604C,652C 'vulner':285C,337C,347C,431C,441C 'waf':87C,107C,118C,147C,171C,381C,457C,483C,523C,550C 'web':280C,332C,426C 'work':128C","nicknames":[],"mitigations":[],"who_affected":"Teams whose Java applications depend on Apache Commons Text versions from 1.5 up to but not including 1.10.0, including through transitive dependencies, and who pass untrusted input into its interpolation features. Teams on 1.10.0 or later, or with no Commons Text dependency, can skip it. The sources do not say which default configurations or input paths are exploitable.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2022-10-13T13:15:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"lab","external_id":"https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html#CVE-2022-42889","url":"https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T17:33:06+00:00","fetched_at":"2026-10-24T17:33:06+00:00","note":"AWS: AWS Managed Rules changelog - AWS WAF, AWS Firewall Manager, AWS Shield Advanced, and AWS Shield network security director"},{"source":"nvd","external_id":"CVE-2022-42889","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42889","severity":null,"published_at":"2022-10-13T13:15:10+00:00","modified_at":"2026-06-17T05:05:31+00:00","first_seen_at":"2026-10-24T18:53:56+00:00","fetched_at":"2026-10-24T18:53:56+00:00","note":null}],"documents":[{"id":2857,"url":"https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html","title":"AWS: AWS Managed Rules changelog - AWS WAF, AWS Firewall Manager, AWS Shield Advanced, and AWS Shield network security director","kind":"advisory","source":"lab","text":"AWS Managed Rules changelog - AWS WAF, AWS Firewall Manager, AWS Shield Advanced, and AWS Shield network security director\n\nIntroducing a new console experience for AWS WAF\n\nYou can now use the updated experience to access AWS WAF functionality anywhere in the console. For more details, see Working with the console. \n\n# AWS Managed Rules changelog\n\nThis section lists changes to the AWS Managed Rules for AWS WAF since their release in November, 2019.\n\n###### Note\n\nThis changelog reports changes to the rules and rule groups in AWS Managed Rules for AWS WAF.\n\nFor the IP reputation rule groups, this changelog reports changes to the rules and rule group, and it reports significant changes to the sources of the IP address lists that the rules use. It does not report changes to the IP address lists themselves, due to the dynamic nature of those lists. If you have questions about the IP address lists, contact your account manager or open a case at \n\nAWS Support Center\n\n. \n\n| Rule group and rules | Description | Date |\n| --- | --- | --- |\n| PHP application managed rule group This release updates the following rules: `PHP2Shell_BODY_Extended` | Released static version 2.5 of this rule group. Improved the detection signatures for the PHP web runtime remote code execution vulnerabilities CVE-2026-109618 and CVE-2026-109619. | 2026-10-22 |\n| PHP application managed rule group This release updates the following rules: `PHP2Shell_BODY_Extended` | Released static version 2.4 of this rule group. The new `PHP2Shell_BODY_Extended` rule adds detection for requests that match the PHP web runtime remote code execution vulnerability CVE-2026-109618. For more information, see NIST: National Vulnerability Database: CVE-2026-109618. This rule group now detects CVE-2026-109618 directly. This supersedes the guidance in the version 2.3 entry, which directed you to the `SizeRestrictions_BODY` rule in the AWS WAF Core rule set (CRS) managed rule group. | 2026-10-22 |\n| PHP application managed rule group This release updates the following rules: `PHP2Shell_BODY` | Released static version 2.3 of this rule group. The new `PHP2Shell_BODY` rule adds detection for requests that match the PHP web runtime remote code execution vulnerability CVE-2026-109619. For more information, see NIST: National Vulnerability Database: CVE-2026-109619. For CVE-2026-109618, the `SizeRestrictions_BODY` rule in the AWS WAF Core rule set (CRS) managed rule group adds protection by blocking request bodies that are over 8 KB (8,192 bytes). | 2026-10-21 |\n| AWS WAF Bot Control rule group | Released static version 7.0 of this rule group. Added token provenance labels at the targeted protection level. These labels flag a change in the category of IP address between the request that acquired an AWS WAF token and the request that presents it. Added device ID labels at the targeted protection level. These labels come from the device ID that the AWS WAF Android SDK collects. Added the cloud service provider label `awswaf:managed:aws:bot-control:signal:cloud_service_provider:fastly`. For more information, see Bot Control labels. | 2026-10-15 |\n| SQL database managed rule group This release updates the following rules: `SQLi_BODY` `SQLiExtendedPatterns_QUERYARGUMENTS` `SQLiExtendedPatterns_BODY` `SQLiExtendedPatterns_HEADER` `SQLiExtendedPatterns_URIPATH` | Released static version 2.5 of this rule group. Updated the `SQLi_BODY` rule and all `SQLiExtendedPatterns` rules to reduce false positives and improve detection. | 2026-09-16 |\n| Core rule set (CRS) managed rule group This release updates the following rules: `CrossSiteScripting_BODY` `CrossSiteScripting_COOKIE` `CrossSiteScripting_QUERYARGUMENTS` `CrossSiteScripting_URIPATH` | Released static version 1.23 of this rule group. Improved detection signatures for the cross site scripting rules. | 2026-08-28 |\n| SQL database managed rule group This release updates the following rules: `SQLi_COOKIE` `SQLi_URIPATH` `SQLi_QUERYARGUMENTS` `SQLi_BODY` `SQLiExtendedPatterns_QUERYARGUMENTS` `SQLiExtendedPatterns_BODY` `SQLiExtendedPatterns_HEADER` `SQLiExtendedPatterns_URIPATH` | Released static version 2.4 of this rule group. This release updates all rules to improve SQL injection detection logic. | 2026-08-12 |\n| AWS WAF Bot Control rule group | Released static version 6.1 of this rule group. Added new bot detection signatures across multiple categories, including Advertising, AI, Content Fetcher, Scraping Framework, Search Engine, Security, SEO, and Social Media. | 2026-07-24 |\n| Core rule set (CRS) managed rule group `GenericLFI_QUERYARGUMENTS` `GenericLFI_URIPATH` `GenericLFI_BODY` | Released static version 1.22 of this rule group. Improved detection signatures for the generic LFI rules. | 2026-07-20 |\n| Known bad inputs managed rule group `ReactJSRCE_BODY` | Released static version 1.26 of this rule group. Added the `REMOVE_NULLS` text transformation to the listed rule. | 2026-07-15 |\n| Windows operating system managed rule group `WindowsShellCommands_HEADER` `WindowsShellCommands_URIPATH` `WindowsShellCommands_BODY` `WindowsShellCommands_QUERYARGUMENTS` `WindowsShellCommands_QUERYSTRING` | Released static version 2.5 of this rule group. Removed `WindowsShellCommands_QUERYARGUMENTS` and replaced it with `WindowsShellCommands_QUERYSTRING`. Updated WindowsShellCommands rules to improve detection logic. | 2026-06-01 |\n| AWS WAF Bot Control rule group | Released static version 6.0 of this rule group. Added new bot detection signatures across multiple categories, including Advertising, Content Fetcher, and Search Engine. Expanded Web Bot Auth support to commercial partition regional AWS WAF integrations. Changed the behavior of Web Bot Auth verified bots to be treated as standard verified bots for all categories, not only the AI category. This static version does not change the default version behavior. | 2026-05-22 |\n| SQL database managed rule group `SQLi_COOKIE` `SQLi_URIPATH` `SQLi_QUERYARGUMENTS` `SQLi_BODY` `SQLiExtendedPatterns_QUERYARGUMENTS` `SQLiExtendedPatterns_BODY` `SQLiExtendedPatterns_HEADER` `SQLiExtendedPatterns_URIPATH` | Released static version 2.3 of this rule group. Added new rules `SQLiExtendedPatterns_HEADER` and `SQLiExtendedPatterns_URIPATH`. Added `REPLACE_COMMENTS` text transformations to all rules. Added `JS_DECODE` text transformations to `SQLi_COOKIE`, `SQLi_URIPATH`, and to all the new rules. Updated all the rules to improve detection logic. Version_2.3 is the successor to Version_1.3, not Version_2.0. These are separate lineages with different detection trade-offs. Customers relying on Version_2.0 detection behavior should pin that version explicitly. | 2026-04-29 |\n| Windows operating system managed rule group `WindowsShellCommands_HEADER` `WindowsShellCommands_COOKIE` `WindowsShellCommands_URIPATH` `WindowsShellCommands_BODY` `WindowsShellCommands_QUERYARGUMENTS` | Released static version 2.4 of this rule group. Removed `WindowsShellCommands_COOKIE` and replaced it with `WindowsShellCommands_HEADER` which matches on all headers. Added new rule `WindowsShellCommands_URIPATH`. Added JSON body inspection to the `WindowsShellCommands_BODY`. Added double `URL_DECODE_UNI` and `JS_DECODE` text transformations to the WindowsShellCommands rules. Updated WindowsShellCommands rules to reduce false positives. | 2026-04-28 |\n| Core rule set (CRS) managed rule group `RestrictedExtensions_QUERYARGUMENTS` `RestrictedExtensions_URIPATH` | Released static version 1.21 of this rule group. Improved detection signatures for these rules. | 2026-04-06 |\n| PHP application managed rule group `PHPHighRiskMethodsVariables_BODY` `PHPHighRiskMethodsVariables_QUERYSTRING` `PHPHighRiskMethodsVariables_HEADER` `PHPHighRiskMethodsVariables_URIPATH` | Released static version 2.2 of this rule group. Improved detections and added `PHPHighRiskMethodsVariables_URIPATH` rule. | 2026-03-24 |\n| AWS WAF Bot Control rule group New rules: `CategoryPagePreview` `CategoryWebhooks` | Released static version 5.0 of this rule group. Added 400+ new bots across multiple categories, including two new bot categories with their respective rules: Page Preview and Webhooks. Key Improvements Improved accuracy of bot detection signals and generic bot pattern matching, resulting in more precise traffic classification. This update changes how the managed rule group prioritizes bot detection. Specific unverified bot patterns are now evaluated before generic patterns and detection signals. This means that requests are more likely to be classified based on their most specific characteristics rather than generic indicators. What this means for your traffic: Generic bot pattern will now match less frequently. These patterns only apply when no more specific bot rule has already identified the traffic. This reduces over-classification and ensures that requests are labeled with the most accurate bot identification available. Detection signals such as indicators that a request originates from a cloud service provider, known bot data center, or uses a non-browser user agent, are now applied after bot identification rules. This ensures that specific bot classifications take precedence over generic traffic signals. Impact: You may see fewer labels for generic bot patterns in your traffic logs, as requests are now more accurately classified by specific bot rules. This provides clearer insight into the actual nature of your automated traffic and reduces noise from overly broad pattern matching. Unverified bot classifications will be more prominent and accurate, helping you better understand and manage automated requests to your applications. Note: This version includes the `awswaf:managed:aws:bot-control:bot:web_bot_auth` labels and rules updates from Version_4.0, but the `Web\n Bot Auth` functionality is still only available in CloudFront. | 2026-02-25 |\n| POSIX operating system managed rule group | Released static version 3.2 of this rule group. Improved detection signatures for all the rules. | 2026-01-15 |\n| Known bad inputs managed rule group `ReactJSRCE_BODY` | Released static version 1.25 of this rule group. Updated the `ReactJSRCE_BODY` to improve detection. | 2025-12-08 |\n| POSIX operating system managed rule group | Released static version 3.1 of this rule group. Improved detection signatures for all the rules. | 2025-12-08 |\n| Known bad inputs managed rule group `ReactJSRCE_BODY` | Released static version 1.24 of this rule group. Updated the `ReactJSRCE_BODY` to improve detection. | 2025-12-04 |\n| AWS WAF Bot Control rule group New labels: `awswaf:managed:aws:bot-control:bot:web_bot_auth ` `verified` – Successful verification `invalid` – Failed verification attempt `expired` –Expired key usage `unknown_bot` – Unrecognized key usage `awswaf:managed:aws:bot-control:bot:vendor<vendor_name>` – Bot vendor or operator `awswaf:managed:aws:bot-control:bot:name<rfc_name>` – Bot name (RFC token from WBA) `awswaf:managed:aws:bot-control:bot:account ` – AWS account identifier. (Amazon Bedrock Agent Core agents only) Scope: CloudFront | Deployed new static version `AWSManagedRulesBotControlRuleSet` Version_4.0 with Web Bot Authentication (WBA) support for cryptographic bot verification. This version must be explicitly selected and does not automatically update existing deployments using the default version. New capabilities: Web Bot Authentication (WBA) cryptographic verification for AI bots and agents Automatic allowlisting of verified WBA bots in Category AI rule Enhanced bot identification with vendor, name, and account labels Support for Amazon Bedrock Agent Core bot detection Rule updates: `Category AI `(Action: Block) Update to not match requests with `web_bot_auth:verified ` label. Verified WBA bots are automatically allowed `TGT_TokenAbsent` (Action: Count) Updated to not match requests with `web_bot_auth:verified` label Important Version_4.0 is a static version only – it does not change the default version behavior. To use WBA features, explicitly select Version _4.0 when configuring your web ACL. | 2025-11-20 |\n| AWS WAF Bot Control rule group New verified bot labels: Advertising: `awswaf:managed:aws:bot-control:bot:name:meta-externalads`– Meta advertising bot `awswaf:managed:aws:bot-control:bot:organization:facebook`– Meta organization AI: `awswaf:managed:aws:bot-control:bot:name:meta-webindexer`– Meta web indexer `awswaf:managed:aws:bot-control:bot:name:perplexity-user`– Perplexity user bot `awswaf:managed:aws:bot-control:bot:name:perplexitybot` – Perplexity bot `awswaf:managed:aws:bot-control:bot:name:bytespider` – Bytespider bot `awswaf:managed:aws:bot-control:bot:name:duckassistbot` – DuckDuckGo assistant bot `awswaf:managed:aws:bot-control:bot:organization:facebook` – Meta organization Content Fetcher: `awswaf:managed:aws:bot-control:bot:name:meta-externalfetcher` – Meta content fetcher `awswaf:managed:aws:bot-control:bot:organization:facebook-externalfetcher` – Meta organization Social Media: `awswaf:managed:aws:bot-control:bot:name:tiktok` – TikTok bot | Key improvements: Expanded verified bot detection across multiple categories (Advertising, AI, Content Fetcher and Social Media) Added organization-level labels for Meta, Facebook bots Enhanced AI bot detection including Perplexity, Bytespider, and DuckDuckGo bots Added TikTok social media bot detection Important Bot category rules in Bot Control trigger only on unverified bots, except for CategoryAI which also triggers on verified bots. Version_3.3 is a static version only – it doesn't change the default version behavior. | 2025-11-17 |\n| Core rule set (CRS) managed rule group `EC2MetaDataSSRF_BODY` `EC2MetaDataSSRF_COOKIE` `EC2MetaDataSSRF_URIPATH` `EC2MetaDataSSRF_QUERYARGUMENTS` | Released static version 1.20 of this rule group. Improved detection signatures for the Server Side Request Forgery (SSRF) rules. | 2025-10-02 |\n| Core rule set (CRS) managed rule group `CrossSiteScripting_BODY` `CrossSiteScripting_COOKIE` `CrossSiteScripting_QUERYARGUMENTS` `CrossSiteScripting_URIPATH` | Released static version 1.19 of this rule group. Improved detection signatures for the cross site scripting rules. | 2025-08-14 |\n| Core rule set (CRS) managed rule group `CrossSiteScripting_BODY` `CrossSiteScripting_COOKIE` `CrossSiteScripting_QUERYARGUMENTS` `CrossSiteScripting_URIPATH` | Released static version 1.18 of this rule group. Improved detection signatures for the cross site scripting rules. | 2025-06-18 |\n| AWS WAF Bot Control rule group New labels: Search engine bots: `awswaf:managed:aws:bot-control:bot:name:evensi` `awswaf:managed:aws:bot-control:bot:name:yisouspider` AI bots: `awswaf:managed:aws:bot-control:bot:name:searchbot` `awswaf:managed:aws:bot-control:bot:name:nova_act` Organization labels for AI bots: `awswaf:managed:aws:bot-control:bot:organization:openai` `awswaf:managed:aws:bot-control:bot:organization:marfeel` `awswaf:managed:aws:bot-control:bot:organization:facebook` `awswaf:managed:aws:bot-control:bot:organization:metaexternalagent` `awswaf:managed:aws:bot-control:bot:organization:amazon` Content fetcher bots: `awswaf:managed:aws:bot-control:bot:name:google_cloud_vertex_bot` Cloud service provider signals: `awswaf:managed:aws:bot-control:signal:cloud_service_provider:alibaba` | Released static version 3.2 of this rule group. Added the listed new labels. | 2025-05-29 |\n| Core rule set (CRS) managed rule group `CrossSiteScripting_BODY` `CrossSiteScripting_COOKIE` `CrossSiteScripting_QUERYARGUMENTS` `CrossSiteScripting_URIPATH` | Released static version 1.17 of this rule group. Improved detection signatures for the cross site scripting rules. | 2025-03-03 |\n| SQL database managed rule group `SQLi_COOKIE` `SQLi_URIPATH` `SQLi_QUERYARGUMENTS` `SQLi_BODY` | Released static version 1.3 of this rule group. Added double `URL_DECODE_UNI` text transformation to the listed rules. | 2025-01-24 |\n| Linux operating system managed rule group `LFI_HEADER` `LFI_URIPATH` `LFI_QUERYSTRING` | Released static version 2.6 of this rule group. Added signatures to improve detection. | 2025-01-24 |\n| AWS WAF Bot Control rule group New bot name label in the Bot Control labels: `awswaf:managed:aws:bot-control:bot::name:nytimes` | Released static version 3.1 of this rule group. Added the New York Times label to the list of bot name labels. | 2024-11-07 |\n| Core rule set (CRS) managed rule group `CrossSiteScripting_BODY``CrossSiteScripting_COOKIE``CrossSiteScripting_QUERYARGUMENTS``CrossSiteScripting_URIPATH` | Released static version 1.16 of this rule group. Improved detection signatures for the cross site scripting rules. | 2024-10-16 |\n| AWS WAF Bot Control rule group New rules: `TGT_TokenAbsent``TGT_VolumetricSessionMaximum``TGT_SignalBrowserAutomationExtension``TGT_ML_CoordinatedActivityLow`, `TGT_ML_CoordinatedActivityMedium`, and `TGT_ML_CoordinatedActivityHigh``TGT_TokenReuseIpLow`, `TGT_TokenReuseIpMedium`, and `TGT_TokenReuseIpHigh``TGT_TokenReuseAsnLow`, `TGT_TokenReuseAsnMedium`, and `TGT_TokenReuseAsnHigh``TGT_TokenReuseCountryLow`, `TGT_TokenReuseCountryMedium`, and `TGT_TokenReuseCountryHigh` Deleted rules: `TGT_TokenReuseIp`. Replaced with the corresponding new low, medium, and high rules. New labels: HTTP Library bots: `awswaf:managed:aws:bot-control:bot:name:fasthttp` AI bots: `awswaf:managed:aws:bot-control:bot:name:bedrockbot``awswaf:managed:aws:bot-control:bot:name:claudebot``awswaf:managed:aws:bot-control:bot:name:anthropic``awswaf:managed:aws:bot-control:bot:name:metaexternalagent``awswaf:managed:aws:bot-control:bot:name:bytespider``awswaf:managed:aws:bot-control:bot:name:omgili``awswaf:managed:aws:bot-control:bot:name:diffbot``awswaf:managed:aws:bot-control:bot:name:perplexitybot``awswaf:managed:aws:bot-control:bot:name:timpibot``awswaf:managed:aws:bot-control:bot:name:cohere` Search engine bots: `awswaf:managed:aws:bot-control:bot:name:naver` Advertising bots: `awswaf:managed:aws:bot-control:bot:name:naver_ads` Social media bots: `awswaf:managed:aws:bot-control:bot:name:snapchat` Content fetcher bots: `awswaf:managed:aws:bot-control:bot:name:naver_preview``awswaf:managed:aws:bot-control:bot:name:censys``awswaf:managed:aws:bot-control:bot:name:imessage_preview``awswaf:managed:aws:bot-control:bot:name:imagesift` Cloud service provider signals: `awswaf:managed:aws:bot-control:signal:cloud_service_provider:aws``awswaf:managed:aws:bot-control:signal:cloud_service_provider:azure``awswaf:managed:aws:bot-control:signal:cloud_service_provider:gcp``awswaf:managed:aws:bot-control:signal:cloud_service_provider:oracle``awswaf:managed:aws:bot-control:signal:cloud_service_provider:digital_ocean``awswaf:managed:aws:bot-control:signal:cloud_service_provider:akamai``awswaf:managed:aws:bot-control:signal:cloud_service_provider:cloudflare``awswaf:managed:aws:bot-control:signal:cloud_service_provider:ibm_cloud` Additional labeling in existing rules. | Released static versions 2.0 and 3.0 of this rule group. Version 2.0 is the same as version 3.0, but with rule actions for all new rules set to Count. This guide documents the latest version of each rule group. Added the listed new rules. Updated labeling so that all rules apply a label with the pattern `awswaf:managed:aws:bot-control: `. Added cloud service provider labels to the Bot Control signal labels. Added new bot name labels that are inspected for by bot category rules. | 2024-09-13 |\n| AWS WAF Fraud Control account takeover prevention (ATP) rule group All rules | Released static version 1.1 of this rule group. Updated labeling so that all rules apply a label with the pattern `awswaf:managed:aws:atp: `. | 2024-09-13 |\n| AWS WAF Fraud Control account creation fraud prevention (ACFP) rule group All rules | Released static version 1.1 of this rule group. Updated labeling so that all rules apply a label with the pattern `awswaf:managed:aws:acfp: `. | 2024-09-13 |\n| Linux operating system managed rule group All rules | Released static version 2.5 of this rule group. Added signatures to improve detection. | 2024-09-02 |\n| Core rule set (CRS) managed rule group `GenericLFI_QUERYARGUMENTS``GenericLFI_URIPATH``GenericLFI_BODY` | Released static version 1.15 of this rule group. Improved detection signatures for the generic LFI rules. | 2024-08-30 |\n| Windows operating system managed rule group `WindowsShellCommands_QUERYARGUMENTS` `WindowsShellCommands_BODY` `WindowsShellCommands_COOKIE` | Released static version 2.3 of this rule group. Adjusted detection signatures in the listed rules to reduce false positives. | 2024-08-28 |\n| WordPress application managed rule group `WordPressExploitableCommands_QUERYSTRING` | Released static version 1.3 of this rule group. Added the JS_DECODE text transformation to the listed rule. | 2024-07-15 |\n| Linux operating system managed rule group `LFI_QUERYSTRING` | Released static version 2.4 of this rule group. Added the JS_DECODE text transformation to the listed rule. | 2024-07-12 |\n| Core rule set (CRS) managed rule group `EC2MetaDataSSRF_BODY``EC2MetaDataSSRF_QUERYARGUMENTS``GenericLFI_QUERYARGUMENTS``GenericLFI_BODY``RestrictedExtensions_QUERYARGUMENTS``GenericRFI_QUERYARGUMENTS``GenericRFI_BODY``CrossSiteScripting_QUERYARGUMENTS``CrossSiteScripting_BODY``CrossSiteScripting_COOKIE``CrossSiteScripting_URIPATH` | Released static version 1.14 of this rule group. Added the JS_DECODE text transformation to the listed rules. | 2024-07-09 |\n| PHP application managed rule group `PHPHighRiskMethodsVariables_BODY` `PHPHighRiskMethodsVariables_QUERYSTRING` | Released static version 2.1 of this rule group. Added the JS_DECODE text transformation to the listed rules. | 2024-07-03 |\n| Windows operating system managed rule group `WindowsShellCommands_QUERYARGUMENTS` `WindowsShellCommands_BODY` `PowerShellCommands_QUERYARGUMENTS` `PowerShellCommands_BODY` | Released static version 2.2 of this rule group. Added the JS_DECODE text transformation to the listed rules. | 2024-07-03 |\n| Linux operating system managed rule group All rules | Released static version 2.3 of this rule group. Added signatures to improve detection. | 2024-06-06 |\n| AWS WAF Bot Control rule group AWS WAF Fraud Control account takeover prevention (ATP) rule group AWS WAF Fraud Control account creation fraud prevention (ACFP) rule group | The bot and fraud rule groups are now versioned. If you're using any of these rule groups, this update doesn't change how they handle your web traffic. This update sets the current rule group version to static version 1.0 and sets the default version to point to it. For more information about versioned managed rules, see the following: Using versioned managed rule groups in AWS WAF Deployments for versioned AWS Managed Rules rule groups Getting notified of new versions and updates to a managed rule group | 2024-05-29 |\n| POSIX operating system managed rule group `UNIXShellCommandsVariables_QUERYARGUMENTS` `UNIXShellCommandsVariables_QUERYSTRING` `UNIXShellCommandsVariables_HEADER` `UNIXShellCommandsVariables_BODY` | Released static version 3.0 of this rule group. Removed `UNIXShellCommandsVariables_QUERYARGUMENTS` and replaced it with `UNIXShellCommandsVariables_QUERYSTRING`. If you have rules that match on the label for `UNIXShellCommandsVariables_QUERYARGUMENTS`, when you use this version, switch them to match on the label for `UNIXShellCommandsVariables_QUERYSTRING`. The new label is `awswaf:managed:aws:posix-os:UNIXShellCommandsVariables_QueryString`. Added the rule `UNIXShellCommandsVariables_HEADER`, which matches on all headers. Updated all the rules in the managed rule group with improved detection logic. Corrected the documented capitalization of the label for `UNIXShellCommandsVariables_BODY`. | 2024-05-28 |\n| Core rule set (CRS) managed rule group `CrossSiteScripting*` | Released static version 1.12 of this rule group. Added signatures to all of the cross site scripting rules to improve detection and reduce false positives. | 2024-05-21 |\n| SQL database managed rule group `SQLi_BODY``SQLi_QUERYARGUMENTS``SQLiExtendedPatterns_QUERYARGUMENTS` | Released static version 1.2 of this rule group. Added the `JS_DECODE` text transformation to the listed rules. | 2024-05-14 |\n| Known bad inputs managed rule group `JavaDeserializationRCE_BODY` `JavaDeserializationRCE_QUERYSTRING` `Log4JRCE_QUERYSTRING` `Log4JRCE_BODY` `Log4JRCE_HEADER` | Released static version 1.22 of this rule group. Added the `JS_DECODE` text transformation to the listed rules. | 2024-05-08 |\n| POSIX operating system managed rule group | Released static version 2.2 of this rule group. Added the `JS_DECODE` text transformation to both rules. | 2024-05-08 |\n| Windows operating system managed rule group `PowerShellCommands_BODY` | Released static version 2.1 of this rule group. Added signatures to `PowerShellCommands_BODY` to improve detection. | 2024-05-03 |\n| Amazon IP reputation list managed rule group `AWSManagedIPReputationList` | Updated the sources of the IP reputation list, to improve identification of addresses that are actively engaging in malicious activities and to reduce false positives. This update doesn't involve a new version because this rule group isn't versioned. | 2024-03-13 |\n| Known bad inputs managed rule group | Released static version 1.21 of this rule group. Added signatures to improve detection and reduce false positives. | 2023-12-16 |\n| Known bad inputs managed rule group `ExploitablePaths_URIPATH` | Released static version 1.20 of this rule group. Updated the `ExploitablePaths_URIPATH` rule to add detection for requests that match the Atlassian Confluence CVE-2023-22518 Improper Authorization vulnerability. This vulnerability affects all versions of Confluence Data Center and Server. For more information, see NIST: National Vulnerability Database: CVE-2023-22518 Detail. | 2023-12-14 |\n| Core rule set (CRS) managed rule group `CrossSiteScripting*` | Released static version 1.11 of this rule group. Added signatures to all of the cross site scripting rules to improve detection and reduce false positives. | 2023-12-06 |\n| AWS WAF Bot Control rule group New label: `awswaf:managed:aws:bot-control:targeted:aggregate:coordinated_activity:low` | Added the coordinated activity low label to the rule group's targeted protection level labels. This label isn't associated with any rule. This labeling is in addition to the medium and high level rules and labels. | 2023-12-05 |\n| Bot Control labels Label: `awswaf:managed:aws:bot-control:targeted:signal:browser_automation_extension` | Added a signal label to the rule group that indicates the detection of a browser extension that assists in automation. This label isn't specific to an individual rule. | 2023-11-14 |\n| Core rule set (CRS) managed rule group `EC2MetaDataSSRF_QUERYARGUMENTS` | Released static version 1.10 of this rule group. Updated one rule to improve detection and reduce false positives. | 2023-11-02 |\n| Core rule set (CRS) managed rule group `EC2MetaDataSSRF_BODY` `EC2MetaDataSSRF_COOKIE` `EC2MetaDataSSRF_URIPATH` `EC2MetaDataSSRF_QUERYARGUMENTS` | Released static version 1.9 of this rule group. Updated rules to improve detection and reduce false positives. | 2023-10-30 |\n| POSIX operating system managed rule group `UNIXShellCommandsVariables_QUERYARGUMENTS` | Released static version 2.1 of this rule group. Updated the query arguments rule to improve detection. | 2023-10-12 |\n| Core rule set (CRS) managed rule group `GenericLFI_QUERYARGUMENTS` `GenericLFI_URIPATH` `RestrictedExtensions_URIPATH` `RestrictedExtensions_QUERYARGUMENTS` | Released static version 1.8 of this rule group. Updated rules to improve detection. | 2023-10-11 |\n| Known bad inputs managed rule group `ExploitablePaths_URIPATH` | Exception deployment: released static version 1.19 of this rule group. Updated the default version to use version 1.19. Updated the `ExploitablePaths_URIPATH` rule to add detection for requests matching the Atlassian Confluence CVE-2023-22515 Privilege Escalation Vulnerability. This vulnerability affects some versions of Atlassian Confluence. For more information, see NIST: National Vulnerability Database: CVE-2023-22515 Detail and Atlassian Support: FAQ for CVE-2023-22515. For information about this deployment type, see Exception deployments for AWS Managed Rules. | 2023-10-04 |\n| Known bad inputs managed rule group `Host_localhost_HEADER` `Log4J*` `JavaDeserialization*` | Exception deployment: released static version 1.18 of this rule group. This is a quick rollout of this static version to accommodate the creation and rollout of version 1.19. Updated the `Host_localhost_HEADER` rule and all Log4J and Java deserialization rules for improved detection. For information about this deployment type, see Exception deployments for AWS Managed Rules. | 2023-10-04 |\n| AWS WAF Bot Control rule group `TGT_TokenReuseIp` `TGT_ML_CoordinatedActivityMedium` `TGT_ML_CoordinatedActivityHigh` | Added rules to the rule group with Count action. The token reuse IP rule detects and counts token sharing across IP addresses. The coordinated activity rules use automated, machine-learning (ML) analysis of website traffic to detect bot-related activity. In your rule group configuration, you can opt out of the use of ML. With this release, customers who are currently using the targeted protection level are opted in to the use of ML. Opting out disables the coordinated activity rules. | 2023-09-06 |\n| AWS WAF Bot Control rule group `CategoryAI` | Added the rule `CategoryAI` to the rule group. | 2023-08-30 |\n| Core rule set (CRS) managed rule group `RestrictedExtensions_URIPATH` `RestrictedExtensions_QUERYARGUMENTS` `EC2MetaDataSSRF_COOKIE` `EC2MetaDataSSRF_QUERYARGUMENTS` `EC2MetaDataSSRF_BODY` `EC2MetaDataSSRF_URIPATH` | Released static version 1.7 of this rule group. Updated restricted extensions and EC2 metadata SSRF rules to improve detection and reduce false positives. | 2023-07-26 |\n| AWS WAF Fraud Control account creation fraud prevention (ACFP) rule group All rules in new rule group | Added the rule group `AWSManagedRulesACFPRuleSet`. | 2023-06-13 |\n| Linux operating system managed rule group `LFI_HEADER` `LFI_URIPATH` `LFI_QUERYSTRING` | Released static version 2.2 of this rule group. Added signatures to improve detection. | 2023-05-22 |\n| Core rule set (CRS) managed rule group `RestrictedExtensions_URIPATH` `RestrictedExtensions_QUERYARGUMENTS` `CrossSiteScripting_COOKIE` `CrossSiteScripting_QUERYARGUMENTS` `CrossSiteScripting_BODY` `CrossSiteScripting_URIPATH` | Released static version 1.6 of this rule group. Updated cross-site scripting (XSS) and restricted extension rules to improve detection and reduce false positives. | 2023-04-28 |\n| PHP application managed rule group Updated `PHPHighRiskMethodsVariables_BODY` Removed `PHPHighRiskMethodsVariables_QUERYARGUMENTS` Added `PHPHighRiskMethodsVariables_QUERYSTRING` Added `PHPHighRiskMethodsVariables_HEADER` | Released static version 2.0 of this rule group. Added signatures to improve detection in all rules. Replaced the rule `PHPHighRiskMethodsVariables_QUERYARGUMENTS` with `PHPHighRiskMethodsVariables_QUERYSTRING`, which inspects the entire query string instead of just the query arguments. Added the rule `PHPHighRiskMethodsVariables_HEADER`, to expand coverage to include all headers. Updated the following labels to align with standard AWS Managed Rules labeling: Old name: `PHPHighRiskMethodsVariables_BODY` New name: `PHPHighRiskMethodsVariables_Body` Old name: `PHPHighRiskMethodsVariables_QUERYARGUMENTS` New name: `PHPHighRiskMethodsVariables_QueryString` | 2023-02-27 |\n| AWS WAF Fraud Control account takeover prevention (ATP) rule group `VolumetricIpFailedLoginResponseHigh` `VolumetricSessionFailedLoginResponseHigh` | Added login response inspection rules for use with protected Amazon CloudFront distributions. These rules can block new login attempts from IP addresses and client sessions that have recently been the source of too many failed login attempts. | 2023-02-15 |\n| Core rule set (CRS) managed rule group `NoUserAgent_HEADER` `CrossSiteScripting_COOKIE` `CrossSiteScripting_QUERYARGUMENTS` `CrossSiteScripting_BODY` `CrossSiteScripting_URIPATH` | Released static version 1.5 of this rule group. Updated Cross Site Scripting (XSS) filters to improve detection. | 2023-01-25 |\n| Linux operating system managed rule group `LFI_COOKIE` - removed `LFI_HEADER` - added `LFI_URIPATH` `LFI_QUERYSTRING` | Released static version 2.1 of this rule group. Removed the rule `LFI_COOKIE` and its label `awswaf:managed:aws:linux-os:LFI_Cookie`, and replaced them with the new rule `LFI_HEADER` and its label `awswaf:managed:aws:linux-os:LFI_Header`. This change expands inspection to multiple headers. Added text transformations and signatures to all rules to improve detection. | 2022-12-15 |\n| Core rule set (CRS) managed rule group `NoUserAgent_HEADER` `CrossSiteScripting_COOKIE` `CrossSiteScripting_QUERYARGUMENTS` `CrossSiteScripting_BODY` `CrossSiteScripting_URIPATH` | Released static version 1.4 of this rule group. Added a text transformation to `NoUserAgent_HEADER` to remove all null bytes. Updated the filters in the cross-site scripting rules to improve detection. | 2022-12-05 |\n| Known bad inputs managed rule group `JavaDeserializationRCE_BODY` `JavaDeserializationRCE_URIPATH` `JavaDeserializationRCE_HEADER` `JavaDeserializationRCE_QUERYSTRING` `Host_localhost_HEADER` | Released static version 1.17 of this rule group. Updated the Java deserialization rules to add detection for requests matching Apache CVE-2022-42889, a remote code execution (RCE) vulnerability in Apache Commons Text versions prior to 1.10.0. For more information, see NIST: National Vulnerability Database: CVE-2022-42889 Detail and CVE-2022-42889: Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults. Improved detection in `Host_localhost_HEADER`. | 2022-10-20 |\n| Known bad inputs managed rule group `Log4JRCE_HEADER` `Log4JRCE_QUERYSTRING` `Log4JRCE_URIPATH` `Log4JRCE_BODY` | Released static version 1.16 of this rule group. Removed false positives that AWS identified in version 1.15. | 2022-10-05 |\n| POSIX operating system managed rule group PHP application managed rule group WordPress application managed rule group | Corrected the documented label names. | 2022-09-19 |\n| IP reputation rule groups `AWSManagedIPDDoSList` | This change doesn't alter how the rule group handles web traffic. Added a new rule with Count action to inspect for IP addresses that are actively engaging in DDoS activities, according to Amazon threat intelligence. | 2022-08-30 |\n| Known bad inputs managed rule group `Log4JRCE` `Log4JRCE_HEADER` `Log4JRCE_QUERYSTRING` `Log4JRCE_URIPATH` `Log4JRCE_BODY` `JavaDeserializationRCE_HEADER` `JavaDeserializationRCE_BODY` `JavaDeserializationRCE_URIPATH` `JavaDeserializationRCE_QUERYSTRING` `Host_localhost_HEADER` `PROPFIND_METHOD` | Released static version 1.15 of this rule group. Removed `Log4JRCE` and replaced it with `Log4JRCE_HEADER`, `Log4JRCE_QUERYSTRING`, `Log4JRCE_URI`, and `Log4JRCE_BODY`, for more granular monitoring and management of false positives. Added signatures for improved detection and blocking to `PROPFIND_METHOD` and to all `JavaDeserializationRCE*` and `Log4JRCE*` rules. Updated labels to correct capitalization in `Host_localhost_HEADER` and in all `JavaDeserializationRCE*` rules. Corrected the description of `JavaDeserializationRCE_HEADER`. | 2022-08-22 |\n| AWS WAF Fraud Control account takeover prevention (ATP) rule group `UnsupportedCognitoIDP` | Added a rule to prevent the use of the account takeover prevention managed rule group for Amazon Cognito user pool web traffic. | 2022-08-11 |\n| Core rule set (CRS) managed rule group | AWS has scheduled expiration for versions `Version_1.2` and `Version_2.0` of the rule group. The versions will expire on September 9, 2022. For information about version expiration, see Using versioned managed rule groups in AWS WAF. | 2022-06-09 |\n| Core rule set (CRS) managed rule group `GenericLFI_URIPATH` `GenericRFI_URIPATH` | Released version 1.3 of this rule group. This release updates the match signatures in the rules `GenericLFI_URIPATH` and `GenericRFI_URIPATH`, to improve detection. | 2022-05-24 |\n| AWS WAF Bot Control rule group `CategoryEmailClient` | Added the rule `CategoryEmailClient` to the rule group. | 2022-04-06 |\n| Known bad inputs managed rule group `JavaDeserializationRCE_HEADER` `JavaDeserializationRCE_BODY` `JavaDeserializationRCE_URI` `JavaDeserializationRCE_QUERYSTRING` | Released version 1.14 of this rule group. The four `JavaDeserializtionRCE` rules are moved to Block mode. | 2022-03-31 |\n| Known bad inputs managed rule group `JavaDeserializationRCE_HEADER_RC_COUNT` `JavaDeserializationRCE_BODY_RC_COUNT` `JavaDeserializationRCE_URI_RC_COUNT` `JavaDeserializationRCE_QUERYSTRING_RC_COUNT` | Released version 1.13 of this rule group. Updated the text transformation for Spring Core and Cloud Function RCE vulnerabilities. These rules are in count mode to gather metrics and evaluate matched patterns. The label can be used to block requests in a custom rule. A subsequent version will be deployed with these rules in block mode. | 2022-03-31 |\n| Known bad inputs managed rule group `JavaDeserializationRCE_HEADER_RC_COUNT` `JavaDeserializationRCE_BODY_RC_COUNT` `JavaDeserializationRCE_URI_RC_COUNT` `JavaDeserializationRCE_QUERYSTRING_RC_COUNT` `Log4JRCE_HEADER` `Log4JRCE_QUERYSTRING` `Log4JRCE_URI` `Log4JRCE_BODY` `Log4JRCE` | Released version 1.12 of this rule group. Added signatures for Spring Core and Cloud Function RCE vulnerabilities. These rules are in count mode to gather metrics and evaluate matched patterns. The label can be used to block requests in a custom rule. A subsequent version will be deployed with these rules in block mode. Removed the rules `Log4JRCE_HEADER`, `Log4JRCE_QUERYSTRING`, `Log4JRCE_URI`, and `Log4JRCE_BODY` and replaced them with the rule `Log4JRCE`. | 2022-03-30 |\n| IP reputation rule groups `AWSManagedReconnaissanceList` | Updated the `AWSManagedReconnaissanceList` rule to change the action from count to block. | 2022-02-15 |\n| AWS WAF Fraud Control account takeover prevention (ATP) rule group All rules in new rule group | Added the rule group `AWSManagedRulesATPRuleSet`. | 2022-02-11 |\n| Known bad inputs managed rule group `Log4JRCE` `Log4JRCE_HEADER` `Log4JRCE_QUERYSTRING` `Log4JRCE_URI` `Log4JRCE_BODY` | Released version 1.9 of this rule group. Removed the rule `Log4JRCE` and replaced it with the rules `Log4JRCE_HEADER`, `Log4JRCE_QUERYSTRING`, `Log4JRCE_URI`, and `Log4JRCE_BODY`, for flexibility in the use of this functionality. Added signatures to improve detection and blocking. | 2022-01-28 |\n| Core rule set (CRS) `CrossSiteScripting_URIPATH``CrossSiteScripting_BODY``CrossSiteScripting_QUERYARGUMENTS``CrossSiteScripting_COOKIE` | Released version 2.0 of this rule group. For these rules, tuned detection signatures to reduce false positives. Replaced the `URL_DECODE` text transformation with the double `URL_DECODE_UNI` text transformation. Added the `HTML_ENTITY_DECODE` text transformation. | 2022-01-10 |\n| Core rule set (CRS) `RestrictedExtensions_URIPATH``RestrictedExtensions_QUERYARGUMENTS` | As part of the release of version 2.0 of this rule group, added the `URL_DECODE_UNI` text transformation. Removed the `URL_DECODE` text transformation from `RestrictedExtensions_URIPATH`. | 2022-01-10 |\n| SQL database `SQLi_BODY``SQLi_QUERYARGUMENTS``SQLi_COOKIE``SQLi_URIPATH``SQLiExtendedPatterns_BODY``SQLiExtendedPatterns_QUERYARGUMENTS` | Released version 2.0 of this rule group. Replaced the `URL_DECODE` text transformation with the double `URL_DECODE_UNI` text transformation and added the `COMPRESS_WHITE_SPACE` text transformation. Added more detection signatures to `SQLiExtendedPatterns_QUERYARGUMENTS`. Added JSON inspection to `SQLi_BODY`. Added the rule `SQLiExtendedPatte","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}