🔔 Release Announcement - SafeLine WAF Version 9.3.0

How to Update

Refer to the official documentation:
https://docs.waf.chaitin.com/en/GetStarted/Upgrade

What’s New in This Version

This release brings a major upgrade to the Semantic Analysis Detection Engine, significantly expanding detection coverage for modern frameworks, NoSQL injections, and multiple protocols, while improving accuracy and stability.

New Vulnerability Rules

JeecgBoot Series

• Added support for JeecgBoot v3.5.1 SQL Injection
• Added support for JeecgBoot v3.5.4 SQL Injection

ThinkPHP Series

• Added support for ThinkPHP5 Remote Code Execution (RCE) – Path
• Added support for ThinkPHP Debug Mode Information Leakage

Vite Series

• Added support for Vite Arbitrary File Read (CVE-2025-30208)
• Added support for Vite Arbitrary File Read (CVE-2025-31125)

MongoDB NoSQL Injection

• Added detection for MongoDB NoSQL Injection via query
• Added detection for MongoDB NoSQL Injection via form
• Added detection for MongoDB NoSQL Injection via JSON key

Other Application Vulnerabilities

• Added support for GitLab Arbitrary File Read (CVE-2020-10977)
• Added support for Pulse Secure SSL VPN Command Injection (CVE-2019-11539)
• Added support for Raspap Command Injection (CVE-2022-39986)
• Added support for Operating System Command Injection in multiple TP-Link products (CVE-2020-12109)
• Added detection for Shiro Permission Bypass

Protocol & General Detection

• Added detection support for file:// protocol calls
• Added identification and detection for SQL built-in functions

Detection Optimizations

Core Logic Enhancements

• Deeply optimized detection engine to improve accuracy for injection attacks and anomalous traffic

Injection Detection Upgrades

• SQL Injection: Continuous logic optimizations
• Command Injection: Deep detection logic enhancements
• Code Injection: Comprehensive optimization for Java, PHP, and ASP
• XSS & SSRF: Improved detection accuracy
• Deserialization: Optimized Java deserialization detection

Traffic & Protocol Parsing

• HTTP Protocol: Improved parsing stability
• File Upload
  • Optimized file upload detection logic
  • Improved detection of mismatches between file content and extensions
  • Optimized configuration parsing for the file upload module
• Response Detection: Optimized server response analysis logic
• Decoding: Improved Hex decoding logic

Logging & Operations

• Improved payload detail display in logs for File Upload and Bot Detection modules

Rule Optimizations

Refined existing rules to reduce false positives and improve detection accuracy for specific CVEs.

Web Frameworks & Components

• Optimized detection rules for Spring Framework vulnerabilities
• Optimized detection for [HW2020] Spring Data REST RCE (CVE-2017-8046)
• Optimized detection for Jeecg-boot v2.1.2–v3.0.0 Unauthorized SQL Injection
• Optimized detection for XStream Deserialization

General Vulnerability Rules

• Optimized Java Code Injection detection
• Optimized detection for suspicious remote calls and JDBC protocol calls
• Optimized detection for Deep Path Traversal attacks
• Optimized detection for XML Entity Injection (UTF-7)
• Optimized detection for LDAP Injection
• Optimized related rules for MongoDB NoSQL Injection (query, form, JSON key)

Sensitive Information & Access Control

• Optimized detection for requests accessing sensitive files
• Optimized detection for low-risk command execution
• Optimized detection for multi-router Operating System Command Injection (CVE-2019-3929)

Bug Fixes

• Fixed an issue where the response detection module could cause anomalies in certain scenarios
• Fixed potential memory issues under high concurrency or special conditions
• Fixed translation issues and improved English UI interactions