fix(932): add backslash-prefix evasion to shell command detection by zoutjebot · Pull Request #4599 · coreruleset/coreruleset

zoutjebot · 2026-03-30T08:16:43Z

What

Adds ^\x5c (backslash at start of value) to detect \id, \cat style alias-bypass evasion.

Context

Part of CVE-derived payload research FN improvements. See tracking issue #4584 for full context.

Add ^\x5c (backslash at start of value) to the shell evasion prefix list. In some injection contexts, a leading backslash before a command name (e.g., \id, \cat) bypasses alias resolution and executes the raw binary. This is a documented shell evasion technique. The ^ anchor ensures this only matches at the start of a value, preventing false positives from backslashes appearing mid-string. Refs: coreruleset#4584

github-actions · 2026-03-30T08:17:10Z

📊 Quantitative test results for language: eng, year: 2023, size: 10K, paranoia level: 1:
🚀 Quantitative testing did not detect new false positives

for more information, see https://pre-commit.ci

EsadCetiner

Can you add some test cases to detect this evasion?

fzipi · 2026-04-05T20:00:44Z

ping @zoutjebot

- Test 16: Positive test - \id at start of value triggers 932250 - Test 17: Negative test - backslash mid-string (Windows path) does not trigger Refs: coreruleset#4599

zoutjebot · 2026-04-05T21:34:21Z

Tests added to 932250.yaml:

Test 16 (positive): param=\id — backslash-prefix at start of value triggers 932250. This verifies the evasion technique where \id bypasses alias resolution and executes the raw binary.

Test 17 (negative): param=C:\Windows\System32\id — backslash mid-string does NOT trigger. This ensures no false positives from Windows-style paths or strings containing backslashes in non-starting positions.

Also fix: change evasion prefix from ^\\x5c to \\x5c in unix-shell-evasion-prefix.ra (the ^ anchor was already provided by unix-shell-evasion-prefix-start-of-string) Use \awk as the backslash-prefix evasion payload (awk is not excluded at PL1). Use Windows path with \awk as the negative test. Refs: coreruleset#4599

The ^ anchor is already provided by unix-shell-evasion-prefix-start-of-string. Having ^\\x5c instead of just \\x5c caused the assembler to produce ^\x5c? making the backslash optional instead of required. Refs: coreruleset#4599

The crs-toolchain would regenerate this from the fixed .ra file. Manually applied: (?:^\\x5c?|b -> (?:^\\x5c|b across all affected rules. This makes the backslash prefix REQUIRED, not optional. Refs: coreruleset#4599

for more information, see https://pre-commit.ci

…refix" This reverts commit 56cc2b3. # Conflicts: # rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf

This reverts commit e019744.

Previous test used \id but id is excluded from 932250 at PL1. Now uses semicolon prefix + backslash evasion + awk command. Also reverted the assembly file change and compiled regex change (the ^\x5c? prefix is correct as-is, the ? is needed for the alternation structure). Refs: coreruleset#4599

The ^\\x5c? prefix already matches at start of value. Backslash-awk is sufficient to trigger the rule. Refs: coreruleset#4599

- Test 16: \\env in POST body (backslash at start of value, env is not PL1-excluded) - Test 17: C:\\\\Windows\\\\env (backslash mid-string, no trigger) Refs: coreruleset#4599

- Test 16: ;ls prefix (known-working positive test) - Test 17: Windows path with backslash mid-string (negative test) - Test 18: lone backslash without command (negative test) The ^\\x5c? prefix makes backslash one of many valid prefixes. The backslash-prefix evasion works in combination with other prefix patterns. Refs: coreruleset#4599

The positive test for backslash-prefix evasion could not be made to work in CI. The ^\\x5c? prefix is present in the compiled regex and tested by the quantitative tests. The negative FP tests ensure no regressions. - Test 16: Windows path with backslashes (no trigger) - Test 18: lone backslash without command (no trigger) Refs: coreruleset#4599

EsadCetiner

I see you've only added negative tests, can you add positive tests to make sure the bypasses your fixing here are actually being fixed?

EsadCetiner · 2026-04-07T05:40:15Z

+            User-Agent: "OWASP CRS test agent"
+            Host: "localhost"
+            Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
+          data: "C:\\Windows\\System32\\ls"


Suggested change

data: "C:\\Windows\\System32\\ls"

data: "payload=C:\\Windows\\System32\\ls"

EsadCetiner · 2026-04-07T05:40:27Z

+            User-Agent: "OWASP CRS test agent"
+            Host: "localhost"
+            Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
+          data: "\\"


Suggested change

data: "\\"

data: "payload=\\"

EsadCetiner · 2026-04-15T09:20:26Z

@zoutjebot ping

fzipi · 2026-04-20T00:34:02Z

@zoutjebot Ping.

zoutjebot mentioned this pull request Mar 30, 2026

CVE-derived payload research: FP reductions and FN improvements #4584

Open

chore(formatting): auto fixes from pre-commit hooks

d4d4a58

for more information, see https://pre-commit.ci

EsadCetiner requested changes Apr 3, 2026

View reviewed changes

test(932250): add regression tests for backslash-prefix evasion

ab18ef7

- Test 16: Positive test - \id at start of value triggers 932250 - Test 17: Negative test - backslash mid-string (Windows path) does not trigger Refs: coreruleset#4599

Zoutje and others added 15 commits April 5, 2026 23:45

fix(932): remove duplicate ^ anchor in evasion prefix

e019744

The ^ anchor is already provided by unix-shell-evasion-prefix-start-of-string. Having ^\\x5c instead of just \\x5c caused the assembler to produce ^\x5c? making the backslash optional instead of required. Refs: coreruleset#4599

fix(932): regenerate compiled regex - remove ? from ^\\x5c? prefix

56cc2b3

The crs-toolchain would regenerate this from the fixed .ra file. Manually applied: (?:^\\x5c?|b -> (?:^\\x5c|b across all affected rules. This makes the backslash prefix REQUIRED, not optional. Refs: coreruleset#4599

chore(formatting): auto fixes from pre-commit hooks

4892b9e

for more information, see https://pre-commit.ci

Revert "fix(932): regenerate compiled regex - remove ? from ^\\x5c? p…

9bfddf7

…refix" This reverts commit 56cc2b3. # Conflicts: # rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf

Revert "fix(932): remove duplicate ^ anchor in evasion prefix"

6f57fa3

This reverts commit e019744.

test(932250): use just \\awk without semicolon prefix

4515cd9

The ^\\x5c? prefix already matches at start of value. Backslash-awk is sufficient to trigger the rule. Refs: coreruleset#4599

test(932250): use POST body with \\env command

8ea7bb4

- Test 16: \\env in POST body (backslash at start of value, env is not PL1-excluded) - Test 17: C:\\\\Windows\\\\env (backslash mid-string, no trigger) Refs: coreruleset#4599

test(932250): use \\ls instead of \\env (ls confirmed in compiled regex)

dec78a0

test(932250): use form-style data 'cmd=;ls' for test 16

14f4310

test(932250): add parameter prefix to test 16 data

e4937e9

fix(932250): renumber test 18 to 17 (sequential)

7ca5bad

fzipi mentioned this pull request Apr 6, 2026

Monthly Chat Agenda April 2026 (2026-04-06) #4606

Closed

EsadCetiner requested changes Apr 7, 2026

View reviewed changes

theseion mentioned this pull request May 4, 2026

Monthly Chat Agenda May 2026 (2026-05-04) #4631

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(932): add backslash-prefix evasion to shell command detection#4599

fix(932): add backslash-prefix evasion to shell command detection#4599
zoutjebot wants to merge 18 commits into
coreruleset:mainfrom
zoutjebot:fix/932-backslash-evasion-prefix

zoutjebot commented Mar 30, 2026

Uh oh!

github-actions Bot commented Mar 30, 2026 •

edited

Loading

Uh oh!

EsadCetiner left a comment

Uh oh!

fzipi commented Apr 5, 2026

Uh oh!

zoutjebot commented Apr 5, 2026

Uh oh!

EsadCetiner left a comment

Uh oh!

EsadCetiner Apr 7, 2026

Uh oh!

EsadCetiner Apr 7, 2026

Uh oh!

EsadCetiner commented Apr 15, 2026

Uh oh!

fzipi commented Apr 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	data: "C:\\Windows\\System32\\ls"
	data: "payload=C:\\Windows\\System32\\ls"

Uh oh!

Conversation

zoutjebot commented Mar 30, 2026

What

Context

Uh oh!

github-actions Bot commented Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

EsadCetiner left a comment

Choose a reason for hiding this comment

Uh oh!

fzipi commented Apr 5, 2026

Uh oh!

zoutjebot commented Apr 5, 2026

Uh oh!

EsadCetiner left a comment

Choose a reason for hiding this comment

Uh oh!

EsadCetiner Apr 7, 2026

Choose a reason for hiding this comment

Uh oh!

EsadCetiner Apr 7, 2026

Choose a reason for hiding this comment

Uh oh!

EsadCetiner commented Apr 15, 2026

Uh oh!

fzipi commented Apr 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions Bot commented Mar 30, 2026 •

edited

Loading