(http_inspect) WEBROOT DIRECTORY TRAVERSAL

The rule is designed to trigger an alert when it detects a potential webroot directory traversal attack in the HTTP request. Directory traversal (also known as path traversal) is a web application vulnerability where an attacker tries to access files or directories outside of the intended web application's root directory. This attack is possible when the web application does not properly validate and sanitize user input used to construct file paths.

ID Number

0000018

Signature

alert ( msg: "HI_CLIENT_WEBROOT_DIR"; sid: 18; gid: 119; rev: 1; metadata: policy max-detect-ips drop, rule-type preproc, service http ; classtype:unknown; reference:cve,2001-0333; reference:cve,2002-1744; reference:cve,2008-5515; reference:cve,2015-0666; )

MITRE ATT&CK Technique

-

Severity

Low

Recommendations/Investigative actions

Can be disabled will trigger many False Positives