From 716e54e597bc74ee8ccb691c6f4e60ac147c460b Mon Sep 17 00:00:00 2001 From: bunkerity Date: Fri, 3 Apr 2020 11:50:54 +0200 Subject: [PATCH] custom http/server confs and better modsec customization --- Dockerfile | 2 +- confs/modsecurity-rules.conf | 8 +- confs/nginx.conf | 3 + confs/owasp-crs.conf | 93 +-- ...00-EXCLUSION-RULES-BEFORE-CRS.conf.example | 4 +- .../owasp-crs/REQUEST-901-INITIALIZATION.conf | 15 +- ...QUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf | 58 +- ...ST-903.9002-WORDPRESS-EXCLUSION-RULES.conf | 170 +++-- ...ST-903.9003-NEXTCLOUD-EXCLUSION-RULES.conf | 18 +- ...EST-903.9004-DOKUWIKI-EXCLUSION-RULES.conf | 24 +- ...QUEST-903.9005-CPANEL-EXCLUSION-RULES.conf | 2 +- ...UEST-903.9006-XENFORO-EXCLUSION-RULES.conf | 509 +++++++++++++++ .../REQUEST-905-COMMON-EXCEPTIONS.conf | 2 +- .../owasp-crs/REQUEST-910-IP-REPUTATION.conf | 28 +- .../REQUEST-911-METHOD-ENFORCEMENT.conf | 9 +- .../owasp-crs/REQUEST-912-DOS-PROTECTION.conf | 4 +- .../REQUEST-913-SCANNER-DETECTION.conf | 31 +- .../REQUEST-920-PROTOCOL-ENFORCEMENT.conf | 480 +++++++------- .../REQUEST-921-PROTOCOL-ATTACK.conf | 75 +-- .../REQUEST-930-APPLICATION-ATTACK-LFI.conf | 38 +- .../REQUEST-931-APPLICATION-ATTACK-RFI.conf | 32 +- .../REQUEST-932-APPLICATION-ATTACK-RCE.conf | 127 ++-- .../REQUEST-933-APPLICATION-ATTACK-PHP.conf | 217 ++++--- ...REQUEST-934-APPLICATION-ATTACK-NODEJS.conf | 94 +++ .../REQUEST-941-APPLICATION-ATTACK-XSS.conf | 332 ++++++---- .../REQUEST-942-APPLICATION-ATTACK-SQLI.conf | 588 +++++++++++------- ...3-APPLICATION-ATTACK-SESSION-FIXATION.conf | 27 +- .../REQUEST-944-APPLICATION-ATTACK-JAVA.conf | 140 +++-- .../REQUEST-949-BLOCKING-EVALUATION.conf | 6 +- .../owasp-crs/RESPONSE-950-DATA-LEAKAGES.conf | 49 +- .../RESPONSE-951-DATA-LEAKAGES-SQL.conf | 120 ++-- .../RESPONSE-952-DATA-LEAKAGES-JAVA.conf | 16 +- .../RESPONSE-953-DATA-LEAKAGES-PHP.conf | 33 +- .../RESPONSE-954-DATA-LEAKAGES-IIS.conf | 29 +- .../RESPONSE-959-BLOCKING-EVALUATION.conf | 10 +- confs/owasp-crs/RESPONSE-980-CORRELATION.conf | 16 +- ...999-EXCLUSION-RULES-AFTER-CRS.conf.example | 2 +- confs/owasp-crs/crawlers-user-agents.data | 6 +- confs/owasp-crs/java-classes.data | 5 + confs/owasp-crs/php-errors.data | 1 - .../owasp-crs/php-function-names-933150.data | 5 + .../owasp-crs/php-function-names-933151.data | 5 - confs/owasp-crs/restricted-files.data | 33 +- confs/owasp-crs/scanners-user-agents.data | 10 + confs/owasp-crs/sql-function-names.data | 236 ------- confs/owasp-crs/unix-shell.data | 37 ++ confs/server.conf | 2 +- entrypoint.sh | 21 +- 48 files changed, 2250 insertions(+), 1522 deletions(-) create mode 100644 confs/owasp-crs/REQUEST-903.9006-XENFORO-EXCLUSION-RULES.conf create mode 100644 confs/owasp-crs/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf delete mode 100644 confs/owasp-crs/sql-function-names.data diff --git a/Dockerfile b/Dockerfile index 470bb2d..7beaf91 100644 --- a/Dockerfile +++ b/Dockerfile @@ -15,7 +15,7 @@ RUN apk --no-cache add php7-fpm certbot libstdc++ libmaxminddb geoip pcre yajl & mkdir /www && \ adduser -h /dev/null -g '' -s /sbin/nologin -D -H nginx -VOLUME /www /confs +VOLUME /www /http-confs /server-confs /modsec-confs /modsec-crs-confs EXPOSE 80/tcp 443/tcp diff --git a/confs/modsecurity-rules.conf b/confs/modsecurity-rules.conf index bf74b09..bdfc18f 100644 --- a/confs/modsecurity-rules.conf +++ b/confs/modsecurity-rules.conf @@ -54,6 +54,10 @@ SecAuditLogRelevantStatus "^(?:5|4(?!04))" SecAuditLogType Serial SecAuditLog /var/log/modsec_audit.log +# include custom rules +%MODSECURITY_INCLUDE_CUSTOM_RULES% + # include OWASP CRS rules -include /etc/nginx/owasp-crs.conf -include /etc/nginx/owasp-crs/*.conf +%MODSECURITY_INCLUDE_CRS% +%MODSECURITY_INCLUDE_CUSTOM_CRS% +%MODSECURITY_INCLUDE_CRS_RULES% diff --git a/confs/nginx.conf b/confs/nginx.conf index f9e708e..b2350cc 100644 --- a/confs/nginx.conf +++ b/confs/nginx.conf @@ -75,4 +75,7 @@ http { # enable/disable ModSecurity %USE_MODSECURITY% + + # custom http confs + include /http-confs/*.conf; } diff --git a/confs/owasp-crs.conf b/confs/owasp-crs.conf index bfc2395..8c0d4eb 100644 --- a/confs/owasp-crs.conf +++ b/confs/owasp-crs.conf @@ -1,5 +1,5 @@ # ------------------------------------------------------------------------ -# OWASP ModSecurity Core Rule Set ver.3.1.1 +# OWASP ModSecurity Core Rule Set ver.3.2.0 # Copyright (c) 2006-2019 Trustwave and contributors. All rights reserved. # # The OWASP ModSecurity Core Rule Set is distributed under @@ -354,11 +354,12 @@ SecDefaultAction "phase:2,log,auditlog,pass" # nolog,\ # pass,\ # t:none,\ +# setvar:tx.crs_exclusions_cpanel=1,\ # setvar:tx.crs_exclusions_drupal=1,\ -# setvar:tx.crs_exclusions_wordpress=1,\ -# setvar:tx.crs_exclusions_nextcloud=1,\ # setvar:tx.crs_exclusions_dokuwiki=1,\ -# setvar:tx.crs_exclusions_cpanel=1" +# setvar:tx.crs_exclusions_nextcloud=1,\ +# setvar:tx.crs_exclusions_wordpress=1,\ +# setvar:tx.crs_exclusions_xenforo=1" # # -- [[ HTTP Policy Settings ]] ------------------------------------------------ @@ -389,7 +390,8 @@ SecDefaultAction "phase:2,log,auditlog,pass" # Content-Types that a client is allowed to send in a request. # Default: application/x-www-form-urlencoded|multipart/form-data|text/xml|\ # application/xml|application/soap+xml|application/x-amf|application/json|\ -# application/octet-stream|text/plain +# application/octet-stream|application/csp-report|\ +# application/xss-auditor-report|text/plain # Uncomment this rule to change the default. #SecAction \ # "id:900220,\ @@ -397,20 +399,7 @@ SecDefaultAction "phase:2,log,auditlog,pass" # nolog,\ # pass,\ # t:none,\ -# setvar:'tx.allowed_request_content_type=application/x-www-form-urlencoded|multipart/form-data|text/xml|application/xml|application/soap+xml|application/x-amf|application/json|application/octet-stream|text/plain'" - -# Content-Types charsets that a client is allowed to send in a request. -# Default: utf-8|iso-8859-1|iso-8859-15|windows-1252 -# Uncomment this rule to change the default. -# Use "|" to separate multiple charsets like in the rule defining -# tx.allowed_request_content_type. -#SecAction \ -# "id:900270,\ -# phase:1,\ -# nolog,\ -# pass,\ -# t:none,\ -# setvar:'tx.allowed_request_content_type_charset=utf-8|iso-8859-1|iso-8859-15|windows-1252'" +# setvar:'tx.allowed_request_content_type=application/x-www-form-urlencoded|multipart/form-data|text/xml|application/xml|application/soap+xml|application/x-amf|application/json|application/octet-stream|application/csp-report|application/xss-auditor-report|text/plain'" # Allowed HTTP versions. # Default: HTTP/1.0 HTTP/1.1 HTTP/2 HTTP/2.0 @@ -428,8 +417,8 @@ SecDefaultAction "phase:2,log,auditlog,pass" # Forbidden file extensions. # Guards against unintended exposure of development/configuration files. -# Default: .asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/ -# Example: .bak/ .config/ .conf/ .db/ .ini/ .log/ .old/ .pass/ .pdb/ .sql/ +# Default: .asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/ +# Example: .bak/ .config/ .conf/ .db/ .ini/ .log/ .old/ .pass/ .pdb/ .rdb/ .sql/ # Uncomment this rule to change the default. #SecAction \ # "id:900240,\ @@ -437,7 +426,7 @@ SecDefaultAction "phase:2,log,auditlog,pass" # nolog,\ # pass,\ # t:none,\ -# setvar:'tx.restricted_extensions=.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/'" +# setvar:'tx.restricted_extensions=.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/'" # Forbidden request headers. # Header names should be lowercase, enclosed by /slashes/ as delimiters. @@ -465,6 +454,18 @@ SecDefaultAction "phase:2,log,auditlog,pass" # t:none,\ # setvar:'tx.static_extensions=/.jpg/ /.jpeg/ /.png/ /.gif/ /.js/ /.css/ /.ico/ /.svg/ /.webp/'" +# Content-Types charsets that a client is allowed to send in a request. +# Default: utf-8|iso-8859-1|iso-8859-15|windows-1252 +# Uncomment this rule to change the default. +# Use "|" to separate multiple charsets like in the rule defining +# tx.allowed_request_content_type. +#SecAction \ +# "id:900280,\ +# phase:1,\ +# nolog,\ +# pass,\ +# t:none,\ +# setvar:'tx.allowed_request_content_type_charset=utf-8|iso-8859-1|iso-8859-15|windows-1252'" # # -- [[ HTTP Argument/Upload Limits ]] ----------------------------------------- @@ -779,52 +780,6 @@ SecDefaultAction "phase:2,log,auditlog,pass" SecCollectionTimeout 600 -# -# -- [[ Debug Mode ]] ---------------------------------------------------------- -# -# To enable rule development and debugging, CRS has an optional debug mode -# that does not block a request, but instead sends detection information -# back to the HTTP client. -# -# This functionality is currently only supported with the Apache web server. -# The Apache mod_headers module is required. -# -# In debug mode, the webserver inserts "X-WAF-Events" / "X-WAF-Score" -# response headers whenever a debug client makes a request. Example: -# -# # curl -v 'http://192.168.1.100/?foo=../etc/passwd' -# X-WAF-Events: TX:930110-OWASP_CRS/WEB_ATTACK/DIR_TRAVERSAL-REQUEST_URI, -# TX:930120-OWASP_CRS/WEB_ATTACK/FILE_INJECTION-ARGS:foo, -# TX:932160-OWASP_CRS/WEB_ATTACK/RCE-ARGS:foo -# X-WAF-Score: Total=15; sqli=0; xss=0; rfi=0; lfi=10; rce=5; php=0; http=0; ses=0 -# -# To enable debug mode, include the RESPONSE-981-DEBUG.conf file. -# This file resides in a separate folder, as it is not compatible with -# nginx and IIS. -# -# You must specify the source IP address/network where you will be running the -# tests from. The source IP will BYPASS all CRS blocking, and will be sent the -# response headers as specified above. Be careful to only list your private -# IP addresses/networks here. -# -# Tip: for regression testing of CRS or your own ModSecurity rules, you may -# be interested in using the OWASP CRS regression testing suite instead. -# View the file util/regression-tests/README for more information. -# -# Uncomment these rules, filling in your CRS path and the source IP address, -# to enable debug mode: -# -#Include /path/to/crs/util/debug/RESPONSE-981-DEBUG.conf -#SecRule REMOTE_ADDR "@ipMatch 192.168.1.100" \ -# "id:900980,\ -# phase:1,\ -# nolog,\ -# pass,\ -# t:none,\ -# ctl:ruleEngine=DetectionOnly,\ -# setvar:tx.crs_debug_mode=1" - - # # -- [[ End of setup ]] -------------------------------------------------------- # @@ -842,4 +797,4 @@ SecAction \ nolog,\ pass,\ t:none,\ - setvar:tx.crs_setup_version=311" + setvar:tx.crs_setup_version=320" diff --git a/confs/owasp-crs/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example b/confs/owasp-crs/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example index bd23616..1fb97cc 100644 --- a/confs/owasp-crs/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example +++ b/confs/owasp-crs/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example @@ -1,5 +1,5 @@ # ------------------------------------------------------------------------ -# OWASP ModSecurity Core Rule Set ver.3.1.1 +# OWASP ModSecurity Core Rule Set ver.3.2.0 # Copyright (c) 2006-2019 Trustwave and contributors. All rights reserved. # # The OWASP ModSecurity Core Rule Set is distributed under @@ -141,7 +141,7 @@ # phase:2,\ # pass,\ # nolog,\ -# ctl:ruleRemoveTargetByTag=CRS;ARGS:pwd" +# ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pwd" # # Example Exclusion Rule: Removing a range of rules diff --git a/confs/owasp-crs/REQUEST-901-INITIALIZATION.conf b/confs/owasp-crs/REQUEST-901-INITIALIZATION.conf index b893794..ec55d00 100644 --- a/confs/owasp-crs/REQUEST-901-INITIALIZATION.conf +++ b/confs/owasp-crs/REQUEST-901-INITIALIZATION.conf @@ -1,5 +1,5 @@ # ------------------------------------------------------------------------ -# OWASP ModSecurity Core Rule Set ver.3.1.1 +# OWASP ModSecurity Core Rule Set ver.3.2.0 # Copyright (c) 2006-2019 Trustwave and contributors. All rights reserved. # # The OWASP ModSecurity Core Rule Set is distributed under @@ -21,11 +21,11 @@ # # Rule version data is added to the "Producer" line of Section H of the Audit log: # -# - Producer: ModSecurity for Apache/2.9.3 (http://www.modsecurity.org/); OWASP_CRS/3.1.1. +# - Producer: ModSecurity for Apache/2.9.1 (http://www.modsecurity.org/); OWASP_CRS/3.1.0. # # Ref: https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#wiki-SecComponentSignature # -SecComponentSignature "OWASP_CRS/3.1.1" +SecComponentSignature "OWASP_CRS/3.2.0" # # -=[ Default setup values ]=- @@ -168,7 +168,7 @@ SecRule &TX:allowed_request_content_type "@eq 0" \ phase:1,\ pass,\ nolog,\ - setvar:'tx.allowed_request_content_type=application/x-www-form-urlencoded|multipart/form-data|text/xml|application/xml|application/soap+xml|application/x-amf|application/json|application/octet-stream|text/plain'" + setvar:'tx.allowed_request_content_type=application/x-www-form-urlencoded|multipart/form-data|text/xml|application/xml|application/soap+xml|application/x-amf|application/json|application/octet-stream|application/csp-report|application/xss-auditor-report|text/plain'" # Default HTTP policy: allowed_request_content_type_charset (rule 900270) SecRule &TX:allowed_request_content_type_charset "@eq 0" \ @@ -192,7 +192,7 @@ SecRule &TX:restricted_extensions "@eq 0" \ phase:1,\ pass,\ nolog,\ - setvar:'tx.restricted_extensions=.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/'" + setvar:'tx.restricted_extensions=.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/'" # Default HTTP policy: restricted_headers (rule 900250) SecRule &TX:restricted_headers "@eq 0" \ @@ -218,7 +218,6 @@ SecRule &TX:enforce_bodyproc_urlencoded "@eq 0" \ nolog,\ setvar:'tx.enforce_bodyproc_urlencoded=0'" - # # -=[ Initialize internal variables ]=- # @@ -298,7 +297,7 @@ SecRule REQBODY_PROCESSOR "!@rx (?:URLENCODED|MULTIPART|XML|JSON)" \ msg:'Enabling body inspection',\ tag:'paranoia-level/1',\ ctl:forceRequestBodyVariable=On,\ - ver:'OWASP_CRS/3.1.1'" + ver:'OWASP_CRS/3.2.0'" # Force body processor URLENCODED SecRule TX:enforce_bodyproc_urlencoded "@eq 1" \ @@ -309,7 +308,7 @@ SecRule TX:enforce_bodyproc_urlencoded "@eq 1" \ nolog,\ noauditlog,\ msg:'Enabling forced body inspection for ASCII content',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ chain" SecRule REQBODY_PROCESSOR "!@rx (?:URLENCODED|MULTIPART|XML|JSON)" \ "ctl:requestBodyProcessor=URLENCODED" diff --git a/confs/owasp-crs/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf b/confs/owasp-crs/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf index 1f511c3..0ba5a68 100644 --- a/confs/owasp-crs/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf +++ b/confs/owasp-crs/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf @@ -1,5 +1,5 @@ # ------------------------------------------------------------------------ -# OWASP ModSecurity Core Rule Set ver.3.1.1 +# OWASP ModSecurity Core Rule Set ver.3.2.0 # Copyright (c) 2006-2019 Trustwave and contributors. All rights reserved. # # The OWASP ModSecurity Core Rule Set is distributed under @@ -117,8 +117,8 @@ SecRule REQUEST_FILENAME "@endsWith /core/install.php" \ phase:2,\ pass,\ nolog,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:account[pass][pass1],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:account[pass][pass2]" + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:account[pass][pass1],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:account[pass][pass2]" SecRule REQUEST_FILENAME "@endsWith /user/login" \ "id:9001112,\ @@ -126,24 +126,24 @@ SecRule REQUEST_FILENAME "@endsWith /user/login" \ pass,\ t:none,\ nolog,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:pass" + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass" SecRule REQUEST_FILENAME "@endsWith /admin/people/create" \ "id:9001114,\ phase:2,\ pass,\ nolog,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:pass[pass1],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:pass[pass2]" + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass[pass1],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass[pass2]" SecRule REQUEST_FILENAME "@rx /user/[0-9]+/edit$" \ "id:9001116,\ phase:2,\ pass,\ nolog,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:current_pass,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:pass[pass1],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:pass[pass2]" + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:current_pass,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass[pass1],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass[pass2]" # @@ -171,14 +171,14 @@ SecRule REQUEST_FILENAME "@endsWith /admin/config/people/accounts" \ nolog,\ ctl:ruleRemoveById=920271,\ ctl:ruleRemoveById=942440,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:user_mail_cancel_confirm_body,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:user_mail_password_reset_body,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:user_mail_register_admin_created_body,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:user_mail_register_no_approval_required_body,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:user_mail_register_pending_approval_body,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:user_mail_status_activated_body,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:user_mail_status_blocked_body,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:user_mail_status_canceled_body" + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:user_mail_cancel_confirm_body,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:user_mail_password_reset_body,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:user_mail_register_admin_created_body,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:user_mail_register_no_approval_required_body,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:user_mail_register_pending_approval_body,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:user_mail_status_activated_body,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:user_mail_status_blocked_body,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:user_mail_status_canceled_body" SecRule REQUEST_FILENAME "@endsWith /admin/config/development/configuration/single/import" \ "id:9001126,\ @@ -242,8 +242,8 @@ SecRule REQUEST_FILENAME "@endsWith /admin/config/content/formats/manage/full_ht phase:2,\ pass,\ nolog,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:editor[settings][toolbar][button_groups],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:filters[filter_html][settings][allowed_html]" + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:editor[settings][toolbar][button_groups],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:filters[filter_html][settings][allowed_html]" # @@ -296,7 +296,7 @@ SecRule REQUEST_METHOD "@streq POST" \ "chain" SecRule REQUEST_HEADERS:Content-Length "@gt 31486341" \ "chain" - SecRule REQUEST_HEADERS:Content-Type "@rx ^(?i)multipart/form-data" \ + SecRule REQUEST_HEADERS:Content-Type "@rx ^(?i)multipart/form-data" \ "chain" SecRule REQUEST_COOKIES:/S?SESS[a-f0-9]+/ "@rx ^[a-zA-Z0-9_-]+" \ "ctl:requestBodyAccess=Off" @@ -316,7 +316,7 @@ SecRule REQUEST_FILENAME "@endsWith /node/add/article" \ phase:2,\ pass,\ nolog,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:body[0][value],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:body[0][value],\ ctl:ruleRemoveTargetById=942410;ARGS:uid[0][target_id]" SecRule REQUEST_FILENAME "@endsWith /node/add/page" \ @@ -324,7 +324,7 @@ SecRule REQUEST_FILENAME "@endsWith /node/add/page" \ phase:2,\ pass,\ nolog,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:body[0][value],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:body[0][value],\ ctl:ruleRemoveTargetById=942410;ARGS:uid[0][target_id]" SecRule REQUEST_FILENAME "@rx /node/[0-9]+/edit$" \ @@ -332,7 +332,7 @@ SecRule REQUEST_FILENAME "@rx /node/[0-9]+/edit$" \ phase:2,\ pass,\ nolog,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:body[0][value],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:body[0][value],\ ctl:ruleRemoveTargetById=942410;ARGS:uid[0][target_id],\ ctl:ruleRemoveTargetById=932110;ARGS:destination" @@ -341,42 +341,42 @@ SecRule REQUEST_FILENAME "@endsWith /block/add" \ phase:2,\ pass,\ nolog,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:body[0][value]" + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:body[0][value]" SecRule REQUEST_FILENAME "@endsWith /admin/structure/block/block-content/manage/basic" \ "id:9001208,\ phase:2,\ pass,\ nolog,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:description" + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:description" SecRule REQUEST_FILENAME "@rx /editor/filter_xss/(?:full|basic)_html$" \ "id:9001210,\ phase:2,\ pass,\ nolog,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:value" + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:value" SecRule REQUEST_FILENAME "@rx /user/[0-9]+/contact$" \ "id:9001212,\ phase:2,\ pass,\ nolog,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:message[0][value]" + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:message[0][value]" SecRule REQUEST_FILENAME "@endsWith /admin/config/development/maintenance" \ "id:9001214,\ phase:2,\ pass,\ nolog,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:maintenance_mode_message" + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:maintenance_mode_message" SecRule REQUEST_FILENAME "@endsWith /admin/config/services/rss-publishing" \ "id:9001216,\ phase:2,\ pass,\ nolog,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:feed_description" + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:feed_description" SecMarker "END-DRUPAL-RULE-EXCLUSIONS" diff --git a/confs/owasp-crs/REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf b/confs/owasp-crs/REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf index 7d8fff7..92c24c0 100644 --- a/confs/owasp-crs/REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf +++ b/confs/owasp-crs/REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf @@ -1,5 +1,5 @@ # ------------------------------------------------------------------------ -# OWASP ModSecurity Core Rule Set ver.3.1.1 +# OWASP ModSecurity Core Rule Set ver.3.2.0 # Copyright (c) 2006-2019 Trustwave and contributors. All rights reserved. # # The OWASP ModSecurity Core Rule Set is distributed under @@ -49,7 +49,7 @@ SecRule REQUEST_FILENAME "@endsWith /wp-login.php" \ pass,\ t:none,\ nolog,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:pwd" + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pwd" # Reset password SecRule REQUEST_FILENAME "@endsWith /wp-login.php" \ @@ -64,9 +64,9 @@ SecRule REQUEST_FILENAME "@endsWith /wp-login.php" \ chain" SecRule &ARGS:action "@eq 1" \ "t:none,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:pass1,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:pass1-text,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:pass2" + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass1,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass1-text,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass2" # @@ -83,6 +83,38 @@ SecRule REQUEST_FILENAME "@endsWith /wp-comments-post.php" \ ctl:ruleRemoveTargetById=931130;ARGS:url" +# +# [ Gutenberg Editor ] +# Used when a user (auto)saves a post/page with Gutenberg. +# + +# Gutenberg +SecRule REQUEST_FILENAME "@rx ^/wp\-json/wp/v[0-9]+/(?:posts|pages)" \ + "id:9002140,\ + phase:1,\ + pass,\ + t:none,\ + nolog,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:content,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:json.content" + +# Gutenberg via rest_route for sites without pretty permalinks +SecRule REQUEST_FILENAME "@endsWith /index.php" \ + "id:9002141,\ + phase:1,\ + pass,\ + t:none,\ + nolog,\ + chain" + SecRule &ARGS:rest_route "@eq 1" \ + "t:none,\ + nolog,\ + chain" + SecRule ARGS:rest_route "@rx ^/wp/v[0-9]+/(?:posts|pages)" \ + "t:none,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:content,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:json.content" + # # [ Live preview ] # Used when an administrator customizes the site and previews the result @@ -221,7 +253,7 @@ SecRule REQUEST_FILENAME "@endsWith /wp-admin/setup-config.php" \ chain" SecRule &ARGS:step "@eq 1" \ "t:none,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:pwd" + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pwd" # WordPress installation: exclude admin password SecRule REQUEST_FILENAME "@endsWith /wp-admin/install.php" \ @@ -236,9 +268,9 @@ SecRule REQUEST_FILENAME "@endsWith /wp-admin/install.php" \ chain" SecRule &ARGS:step "@eq 1" \ "t:none,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:admin_password,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:admin_password2,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:pass1-text" + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:admin_password,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:admin_password2,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass1-text" # @@ -261,9 +293,11 @@ SecRule REQUEST_FILENAME "@endsWith /wp-admin/profile.php" \ ctl:ruleRemoveTargetById=931130;ARGS:url,\ ctl:ruleRemoveTargetById=931130;ARGS:facebook,\ ctl:ruleRemoveTargetById=931130;ARGS:googleplus,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:pass1,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:pass1-text,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:pass2" + ctl:ruleRemoveTargetById=931130;ARGS:instagram,\ + ctl:ruleRemoveTargetById=931130;ARGS:linkedin,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass1,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass1-text,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass2" # Edit user SecRule REQUEST_FILENAME "@endsWith /wp-admin/user-edit.php" \ @@ -279,9 +313,9 @@ SecRule REQUEST_FILENAME "@endsWith /wp-admin/user-edit.php" \ SecRule &ARGS:action "@eq 1" \ "t:none,\ ctl:ruleRemoveTargetById=931130;ARGS:url,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:pass1,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:pass1-text,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:pass2" + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass1,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass1-text,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass2" # Create user SecRule REQUEST_FILENAME "@endsWith /wp-admin/user-new.php" \ @@ -297,9 +331,9 @@ SecRule REQUEST_FILENAME "@endsWith /wp-admin/user-new.php" \ SecRule &ARGS:action "@eq 1" \ "t:none,\ ctl:ruleRemoveTargetById=931130;ARGS:url,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:pass1,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:pass1-text,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:pass2" + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass1,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass1-text,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass2" # @@ -321,6 +355,7 @@ SecAction \ ctl:ruleRemoveTargetById=942200;ARGS:_wp_http_referer,\ ctl:ruleRemoveTargetById=942260;ARGS:_wp_http_referer,\ ctl:ruleRemoveTargetById=942431;ARGS:_wp_http_referer,\ + ctl:ruleRemoveTargetById=942440;ARGS:_wp_http_referer,\ ctl:ruleRemoveTargetById=920230;ARGS:wp_http_referer,\ ctl:ruleRemoveTargetById=931130;ARGS:wp_http_referer,\ ctl:ruleRemoveTargetById=932150;ARGS:wp_http_referer,\ @@ -352,7 +387,7 @@ SecRule REQUEST_FILENAME "@endsWith /wp-admin/post.php" \ SecRule &ARGS:action "@eq 1" \ "t:none,\ ctl:ruleRemoveTargetByTag=attack-sqli;ARGS:post_title,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:content,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:content,\ ctl:ruleRemoveById=920272,\ ctl:ruleRemoveById=921180" @@ -371,7 +406,7 @@ SecRule REQUEST_FILENAME "@endsWith /wp-admin/admin-ajax.php" \ SecRule &ARGS:action "@eq 1" \ "t:none,\ ctl:ruleRemoveTargetByTag=attack-sqli;ARGS:data[wp_autosave][post_title],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:data[wp_autosave][content],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:data[wp_autosave][content],\ ctl:ruleRemoveTargetById=942431;ARGS_NAMES:data[wp-refresh-post-lock][post_id],\ ctl:ruleRemoveTargetById=942431;ARGS_NAMES:data[wp-refresh-post-lock][lock],\ ctl:ruleRemoveTargetById=942431;ARGS_NAMES:data[wp-check-locked-posts][],\ @@ -415,46 +450,46 @@ SecRule REQUEST_FILENAME "@endsWith /wp-admin/admin-ajax.php" \ chain" SecRule &ARGS:action "@eq 1" \ "t:none,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[0][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[1][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[2][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[3][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[4][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[5][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[6][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[7][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[8][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[9][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[10][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[11][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[12][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[13][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[14][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[15][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[16][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[17][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[18][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[19][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[20][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[21][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[22][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[23][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[24][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[25][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[26][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[27][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[28][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[29][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[30][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[31][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[32][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[33][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[34][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[35][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[36][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[37][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[38][text],\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:widget-text[39][text]" + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[0][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[1][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[2][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[3][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[4][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[5][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[6][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[7][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[8][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[9][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[10][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[11][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[12][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[13][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[14][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[15][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[16][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[17][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[18][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[19][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[20][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[21][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[22][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[23][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[24][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[25][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[26][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[27][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[28][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[29][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[30][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[31][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[32][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[33][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[34][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[35][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[36][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[37][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[38][text],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[39][text]" # Reorder widgets SecRule REQUEST_FILENAME "@endsWith /wp-admin/admin-ajax.php" \ @@ -527,7 +562,7 @@ SecRule REQUEST_FILENAME "@endsWith /wp-admin/admin-ajax.php" \ chain" SecRule &ARGS:action "@eq 1" \ "t:none,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:html" + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:html" # @@ -591,8 +626,17 @@ SecRule REQUEST_FILENAME "@endsWith /wp-admin/options.php" \ chain" SecRule &ARGS:action "@eq 1" \ "t:none,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:blacklist_keys,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:moderation_keys" + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:blacklist_keys,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:moderation_keys" + +# Posts/pages overview search +SecRule REQUEST_FILENAME "@endsWith /wp-admin/edit.php" \ + "id:9002830,\ + phase:1,\ + pass,\ + t:none,\ + nolog,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:s" # diff --git a/confs/owasp-crs/REQUEST-903.9003-NEXTCLOUD-EXCLUSION-RULES.conf b/confs/owasp-crs/REQUEST-903.9003-NEXTCLOUD-EXCLUSION-RULES.conf index f667c5f..e1dca51 100644 --- a/confs/owasp-crs/REQUEST-903.9003-NEXTCLOUD-EXCLUSION-RULES.conf +++ b/confs/owasp-crs/REQUEST-903.9003-NEXTCLOUD-EXCLUSION-RULES.conf @@ -1,5 +1,5 @@ # ------------------------------------------------------------------------ -# OWASP ModSecurity Core Rule Set ver.3.1.1 +# OWASP ModSecurity Core Rule Set ver.3.2.0 # Copyright (c) 2006-2019 Trustwave and contributors. All rights reserved. # # The OWASP ModSecurity Core Rule Set is distributed under @@ -123,7 +123,7 @@ SecRule REQUEST_METHOD "@streq PUT" \ chain" SecRule REQUEST_FILENAME "@rx (?:/public\.php/webdav/|/remote\.php/dav/uploads/)" \ "ctl:ruleRemoveById=920340,\ - ctl:ruleRemoveById=920420" + ctl:ruleRemoveById=920420" # Allow characters like /../ in files. @@ -243,7 +243,7 @@ SecRule REQUEST_FILENAME "@contains /index.php/apps/files_texteditor/" \ pass,\ t:none,\ nolog,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:filecontents,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:filecontents,\ ctl:ruleRemoveTargetById=921110-921160;ARGS:filecontents,\ ctl:ruleRemoveTargetById=932150;ARGS:filename,\ ctl:ruleRemoveTargetById=920370-920390;ARGS:filecontents,\ @@ -318,7 +318,7 @@ SecRule REQUEST_FILENAME "@contains /index.php/login" \ t:none,\ nolog,\ ctl:ruleRemoveTargetById=941100;ARGS:requesttoken,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:password" + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:password" # Reset password. @@ -334,9 +334,9 @@ SecRule REQUEST_FILENAME "@endsWith /index.php/login" \ chain" SecRule &ARGS:action "@eq 1" \ "t:none,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:pass1,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:pass1-text,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:pass2" + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass1,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass1-text,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass2" # Change Password and Setting up a new user/password @@ -346,8 +346,8 @@ SecRule REQUEST_FILENAME "@endsWith /index.php/settings/users" \ pass,\ t:none,\ nolog,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:newuserpassword,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:password" + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:newuserpassword,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:password" SecMarker "END-NEXTCLOUD-ADMIN" diff --git a/confs/owasp-crs/REQUEST-903.9004-DOKUWIKI-EXCLUSION-RULES.conf b/confs/owasp-crs/REQUEST-903.9004-DOKUWIKI-EXCLUSION-RULES.conf index dfb180f..a0b5dd2 100644 --- a/confs/owasp-crs/REQUEST-903.9004-DOKUWIKI-EXCLUSION-RULES.conf +++ b/confs/owasp-crs/REQUEST-903.9004-DOKUWIKI-EXCLUSION-RULES.conf @@ -1,5 +1,5 @@ # ------------------------------------------------------------------------ -# OWASP ModSecurity Core Rule Set ver.3.1.1 +# OWASP ModSecurity Core Rule Set ver.3.2.0 # Copyright (c) 2006-2019 Trustwave and contributors. All rights reserved. # # The OWASP ModSecurity Core Rule Set is distributed under @@ -85,17 +85,17 @@ SecRule REQUEST_FILENAME "@rx (?:/doku.php|/lib/exe/ajax.php)$" \ SecRule REQUEST_COOKIES:/S?DW[a-f0-9]+/ "@rx ^[%a-zA-Z0-9_-]+" \ "t:none,\ ctl:ruleRemoveTargetByTag=attack-protocol;ARGS:wikitext,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:wikitext,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:wikitext,\ ctl:ruleRemoveTargetByTag=attack-protocol;ARGS:suffix,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:suffix,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:suffix,\ ctl:ruleRemoveTargetByTag=attack-protocol;ARGS:prefix,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:prefix,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:prefix,\ ctl:ruleRemoveTargetById=930100-930110;REQUEST_BODY" # Allow it to upload files. But check for cookies just to make sure. -SecRule REQUEST_FILENAME "@endsWith /lib/exe/ajax.php"\ +SecRule REQUEST_FILENAME "@endsWith /lib/exe/ajax.php" \ "id:9004110,\ phase:2,\ pass,\ @@ -113,7 +113,7 @@ SecRule REQUEST_FILENAME "@endsWith /lib/exe/ajax.php"\ # Show the index, even if things like "postgresql" or other things show up. -SecRule REQUEST_FILENAME "@endsWith /doku.php"\ +SecRule REQUEST_FILENAME "@endsWith /doku.php" \ "id:9004130,\ phase:2,\ pass,\ @@ -137,7 +137,7 @@ SecRule REQUEST_FILENAME "@endsWith /doku.php"\ # Turn off checks for password. SecRule REQUEST_FILENAME "@endsWith /doku.php" \ - "id:9004200,\ + "id:9004200,\ phase:2,\ pass,\ t:none,\ @@ -149,7 +149,7 @@ SecRule REQUEST_FILENAME "@endsWith /doku.php" \ chain" SecRule &ARGS:do "@eq 1" \ "t:none,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:p" + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:p" # @@ -188,12 +188,12 @@ SecRule REQUEST_FILENAME "@endsWith /doku.php" \ chain" SecRule ARGS:do "@streq login" \ "t:none,\ - chain" + chain" SecRule &ARGS:do "@eq 1" \ "t:none,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:pass1,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:pass1-text,\ - ctl:ruleRemoveTargetByTag=CRS;ARGS:pass2" + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass1,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass1-text,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass2" # [ Save config ] diff --git a/confs/owasp-crs/REQUEST-903.9005-CPANEL-EXCLUSION-RULES.conf b/confs/owasp-crs/REQUEST-903.9005-CPANEL-EXCLUSION-RULES.conf index 1553364..46d6762 100644 --- a/confs/owasp-crs/REQUEST-903.9005-CPANEL-EXCLUSION-RULES.conf +++ b/confs/owasp-crs/REQUEST-903.9005-CPANEL-EXCLUSION-RULES.conf @@ -1,5 +1,5 @@ # ------------------------------------------------------------------------ -# OWASP ModSecurity Core Rule Set ver.3.1.1 +# OWASP ModSecurity Core Rule Set ver.3.2.0 # Copyright (c) 2006-2019 Trustwave and contributors. All rights reserved. # # The OWASP ModSecurity Core Rule Set is distributed under diff --git a/confs/owasp-crs/REQUEST-903.9006-XENFORO-EXCLUSION-RULES.conf b/confs/owasp-crs/REQUEST-903.9006-XENFORO-EXCLUSION-RULES.conf new file mode 100644 index 0000000..2ce34c7 --- /dev/null +++ b/confs/owasp-crs/REQUEST-903.9006-XENFORO-EXCLUSION-RULES.conf @@ -0,0 +1,509 @@ +# ------------------------------------------------------------------------ +# OWASP ModSecurity Core Rule Set ver.3.2.0 +# Copyright (c) 2006-2019 Trustwave and contributors. All rights reserved. +# +# The OWASP ModSecurity Core Rule Set is distributed under +# Apache Software License (ASL) version 2 +# Please see the enclosed LICENSE file for full details. +# ------------------------------------------------------------------------ + +# These exclusions remedy false positives in a default XenForo install. +# The exclusions are only active if crs_exclusions_xenforo=1 is set. +# See rule 900130 in crs-setup.conf.example for instructions. + +SecRule &TX:crs_exclusions_xenforo|TX:crs_exclusions_xenforo "@eq 0" \ + "id:9006000,\ + phase:1,\ + pass,\ + t:none,\ + nolog,\ + skipAfter:END-XENFORO" + +SecRule &TX:crs_exclusions_xenforo|TX:crs_exclusions_xenforo "@eq 0" \ + "id:9006001,\ + phase:2,\ + pass,\ + t:none,\ + nolog,\ + skipAfter:END-XENFORO" + + +# +# -=[ XenForo Front-End ]=- +# + +# Proxy for images and remote content embedded in forum posts +# GET /xf/proxy.php?image=https://example.com/some.jpg&hash=foo +# GET /xf/proxy.php?link=https://example.com&hash=foo +# POST /xf/proxy.php, body: referrer=... +SecRule REQUEST_FILENAME "@endsWith /proxy.php" \ + "id:9006100,\ + phase:1,\ + pass,\ + t:none,\ + nolog,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:image,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:link,\ + ctl:ruleRemoveTargetById=931130;ARGS:referrer,\ + ctl:ruleRemoveTargetById=942230;ARGS:referrer" + +# Store drafts for private message, forum post, thread reply +# POST /xf/conversations/draft +# POST /xf/conversations/convo-title.12345/draft +# POST /xf/forums/forum-title.12345/draft +# POST /xf/threads/thread-title-%E2%98%85.12345/draft +# +# attachment_hash_combined example: +# {"type":"post","context":{"post_id":12345},"hash":"0123456789abcdef..."} +SecRule REQUEST_FILENAME "@rx /(?:conversations|(?:conversations|forums|threads)/.*\.\d+)/draft$" \ + "id:9006110,\ + phase:2,\ + pass,\ + t:none,\ + nolog,\ + ctl:ruleRemoveTargetById=931130;ARGS:href,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:title,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:message,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:message_html,\ + ctl:ruleRemoveTargetById=942200;ARGS:attachment_hash_combined,\ + ctl:ruleRemoveTargetById=942260;ARGS:attachment_hash_combined,\ + ctl:ruleRemoveTargetById=942340;ARGS:attachment_hash_combined,\ + ctl:ruleRemoveTargetById=942370;ARGS:attachment_hash_combined" + +# Send PM, edit post, create thread, reply to thread +# POST /xf/conversations/add +# POST /xf/conversations/add-preview +# POST /xf/conversations/messages/1463947/edit +# POST /xf/posts/12345/edit +# POST /xf/posts/12345/preview +# POST /xf/conversations/convo-title.12345/add-reply +# POST /xf/threads/thread-title.12345/add-reply +# POST /xf/threads/thread-title.12345/reply-preview +# POST /xf/forums/forum-title.12345/post-thread +# POST /xf/forums/forum-title.12345/thread-preview +SecRule REQUEST_FILENAME "@rx /(?:conversations/add(?:-preview)?|conversations/messages/\d+/edit|posts/\d+/(?:edit|preview)|(?:conversations|threads)/.*\.\d+/(?:add-reply|reply-preview)|forums/.*\.\d+/(?:post-thread|thread-preview))$" \ + "id:9006120,\ + phase:2,\ + pass,\ + t:none,\ + nolog,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:title,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:message,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:message_html,\ + ctl:ruleRemoveTargetById=942200;ARGS:attachment_hash_combined,\ + ctl:ruleRemoveTargetById=942260;ARGS:attachment_hash_combined,\ + ctl:ruleRemoveTargetById=942340;ARGS:attachment_hash_combined,\ + ctl:ruleRemoveTargetById=942370;ARGS:attachment_hash_combined" + +# Quote +# POST /xf/posts/12345/quote +SecRule REQUEST_FILENAME "@rx /posts/\d+/quote$" \ + "id:9006130,\ + phase:2,\ + pass,\ + t:none,\ + nolog,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:quoteHtml" + +# Multi quote +# POST /xf/conversations/convo-title.12345/multi-quote +# POST /xf/threads/thread-title.12345/multi-quote +# quotes={"12345":["quote-html"]} +SecRule REQUEST_FILENAME "@rx /(?:conversations|threads)/.*\.\d+/multi-quote$" \ + "id:9006140,\ + phase:2,\ + pass,\ + t:none,\ + nolog,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:quotes,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:insert[0][value],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:insert[1][value],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:insert[2][value],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:insert[3][value],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:insert[4][value],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:insert[5][value],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:insert[6][value],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:insert[7][value],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:insert[8][value],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:insert[9][value]" + +# Delete thread +SecRule REQUEST_FILENAME "@rx /threads/.*\.\d+/delete$" \ + "id:9006150,\ + phase:2,\ + pass,\ + t:none,\ + nolog,\ + ctl:ruleRemoveTargetById=942130;ARGS:starter_alert_reason" + +# Inline moderate thread +# POST /xf/inline-mod/ +SecRule REQUEST_FILENAME "@streq /inline-mod/" \ + "id:9006160,\ + phase:2,\ + pass,\ + t:none,\ + nolog,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:message" + +# Warn member +# POST /xf/members/name.12345/warn +SecRule REQUEST_FILENAME "@rx /members/\*\.\d+/warn$" \ + "id:9006170,\ + phase:2,\ + pass,\ + t:none,\ + nolog,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:conversation_message,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:notes" + +# Editor +SecRule REQUEST_URI "@endsWith /index.php?editor/to-html" \ + "id:9006200,\ + phase:2,\ + pass,\ + t:none,\ + nolog,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:bb_code,\ + ctl:ruleRemoveTargetById=942200;ARGS:attachment_hash_combined,\ + ctl:ruleRemoveTargetById=942260;ARGS:attachment_hash_combined,\ + ctl:ruleRemoveTargetById=942340;ARGS:attachment_hash_combined,\ + ctl:ruleRemoveTargetById=942370;ARGS:attachment_hash_combined" + +# Editor +SecRule REQUEST_URI "@endsWith /index.php?editor/to-bb-code" \ + "id:9006210,\ + phase:2,\ + pass,\ + t:none,\ + nolog,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:html" + +# Post attachment +# POST /xf/account/avatar +# POST /xf/attachments/upload?type=post&context[thread_id]=12345&hash=foo +SecRule REQUEST_FILENAME "@rx /(?:account/avatar|attachments/upload)$" \ + "id:9006220,\ + phase:1,\ + pass,\ + t:none,\ + nolog,\ + ctl:ruleRemoveById=200003,\ + ctl:ruleRemoveTargetById=942220;ARGS:flowChunkSize,\ + ctl:ruleRemoveTargetById=942440;ARGS:flowIdentifier,\ + ctl:ruleRemoveTargetById=942440;ARGS:flowFilename,\ + ctl:ruleRemoveTargetById=942440;ARGS:flowRelativePath" + +# Media +# POST /xf/index.php?editor/media +SecRule REQUEST_URI "@endsWith /index.php?editor/media" \ + "id:9006230,\ + phase:2,\ + pass,\ + t:none,\ + nolog,\ + ctl:ruleRemoveTargetById=931130;ARGS:url,\ + ctl:ruleRemoveTargetById=942130;ARGS:url" + +# Emoji +# GET /xf/index.php?misc/find-emoji&q=(%0A%0A +SecRule REQUEST_URI "@rx /index\.php\?misc/find-emoji&q=" \ + "id:9006240,\ + phase:1,\ + pass,\ + t:none,\ + nolog,\ + ctl:ruleRemoveTargetById=921151;ARGS:q" + +# Login +# POST /xf/login/login +SecRule REQUEST_FILENAME "@endsWith /login/login" \ + "id:9006300,\ + phase:2,\ + pass,\ + t:none,\ + nolog,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:password" + +# Register account +# POST /xf/register/register +# The password is passed in a variable-name form parameter. We don't +# want to exclude all parameters completely as this would cause an +# unacceptable bypass. So, we exclude only commonly hit rules. +SecRule REQUEST_FILENAME "@endsWith /register/register" \ + "id:9006310,\ + phase:2,\ + pass,\ + t:none,\ + nolog,\ + ctl:ruleRemoveTargetById=942130;ARGS,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:reg_key" + +# Edit account +# POST /xf/account/account-details +SecRule REQUEST_FILENAME "@endsWith /account/account-details" \ + "id:9006320,\ + phase:2,\ + pass,\ + t:none,\ + nolog,\ + ctl:ruleRemoveTargetById=931130;ARGS:custom_fields[picture],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:about_html" + +# Lost password +# POST /xf/lost-password/user-name.12345/confirm?c=foo +SecRule REQUEST_FILENAME "@rx /lost-password/.*\.\d+/confirm$" \ + "id:9006330,\ + phase:2,\ + pass,\ + t:none,\ + nolog,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:c" + +# Set forum signature +# POST /xf/account/signature +SecRule REQUEST_FILENAME "@endsWith /account/signature" \ + "id:9006340,\ + phase:2,\ + pass,\ + t:none,\ + nolog,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:signature_html" + +# Search +# POST /xf/search/search +SecRule REQUEST_FILENAME "@endsWith /search/search" \ + "id:9006400,\ + phase:2,\ + pass,\ + t:none,\ + nolog,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:keywords,\ + ctl:ruleRemoveTargetById=942200;ARGS:constraints,\ + ctl:ruleRemoveTargetById=942260;ARGS:constraints,\ + ctl:ruleRemoveTargetById=942340;ARGS:constraints,\ + ctl:ruleRemoveTargetById=942370;ARGS:constraints" + +# Search within thread +# GET /xf/threads/foo.12345/page12?highlight=foo +SecRule REQUEST_FILENAME "@rx /threads/.*\.\d+/(?:page\d+)?$" \ + "id:9006410,\ + phase:1,\ + pass,\ + t:none,\ + nolog,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:highlight" + +# Search within search result +# GET /xf/search/12345/?q=foo +SecRule REQUEST_FILENAME "@rx /search/\d+/$" \ + "id:9006420,\ + phase:1,\ + pass,\ + t:none,\ + nolog,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:q" + +# Contact form +# POST /xf/misc/contact +SecRule REQUEST_FILENAME "@endsWith /misc/contact" \ + "id:9006500,\ + phase:2,\ + pass,\ + t:none,\ + nolog,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:message,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:subject" + +# Report post +# POST /xf/posts/12345/report +SecRule REQUEST_FILENAME "@rx /posts/\d+/report$" \ + "id:9006510,\ + phase:2,\ + pass,\ + t:none,\ + nolog,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:message" + +# Alternate thread view route +# /xf/index.php?threads/title-having-some-sql.12345/ +# +# Especially threads with the HAVING sql keyword are FP prone. +# This rule has some chains to narrow down the exclusion, +# making it harder for an attacker to abuse the ARGS_NAMES +# exclusion on other endpoints. +SecRule REQUEST_FILENAME "@endsWith /index.php" \ + "id:9006600,\ + phase:1,\ + pass,\ + t:none,\ + nolog,\ + chain" + SecRule REQUEST_METHOD "@streq GET" \ + "t:none,\ + chain" + SecRule &ARGS "@eq 1" \ + "t:none,\ + chain" + SecRule REQUEST_URI "@rx /index\.php\?threads/.*\.\d+/$" \ + "t:none,\ + ctl:ruleRemoveTargetById=942100;ARGS_NAMES,\ + ctl:ruleRemoveTargetById=942230;ARGS_NAMES" + +# Browser fingerprint (DBTech security extension) +# May Contain various javascript/XSS false positives +SecRule REQUEST_URI "@endsWith /index.php?dbtech-security/fingerprint" \ + "id:9006700,\ + phase:2,\ + pass,\ + t:none,\ + nolog,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:components[14][value],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:components[15][value],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:components[16][value]" + +# Get location info +SecRule REQUEST_FILENAME "@endsWith /misc/location-info" \ + "id:9006710,\ + phase:2,\ + pass,\ + t:none,\ + nolog,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:location" + +# +# -=[ XenForo Global Exclusions ]=- +# + +# _xfRedirect, _xfRequestUri can appear on various endpoints. +# Cookies can appear on all endpoints. + +SecAction \ + "id:9006800,\ + phase:1,\ + pass,\ + t:none,\ + nolog,\ + ctl:ruleRemoveTargetById=931120;ARGS:_xfRedirect,\ + ctl:ruleRemoveTargetById=941150;ARGS:_xfRedirect,\ + ctl:ruleRemoveTargetById=931120;ARGS:_xfRequestUri,\ + ctl:ruleRemoveTargetById=941150;ARGS:_xfRequestUri,\ + ctl:ruleRemoveTargetById=942130;ARGS:_xfRequestUri,\ + ctl:ruleRemoveTargetById=942230;ARGS:_xfRequestUri,\ + ctl:ruleRemoveTargetById=942260;ARGS:_xfRequestUri,\ + ctl:ruleRemoveTargetById=942100;REQUEST_COOKIES:xf_csrf,\ + ctl:ruleRemoveTargetById=942210;REQUEST_COOKIES:xf_csrf,\ + ctl:ruleRemoveTargetById=942440;REQUEST_COOKIES:xf_csrf,\ + ctl:ruleRemoveTargetById=942150;REQUEST_COOKIES:xf_emoji_usage,\ + ctl:ruleRemoveTargetById=942410;REQUEST_COOKIES:xf_emoji_usage,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;REQUEST_COOKIES:xf_ls,\ + ctl:ruleRemoveTargetById=942100;REQUEST_COOKIES:xf_user" + +# +# -=[ XenForo Administration Back-End ]=- +# + +# Skip this section for performance unless requested file is admin.php + +SecRule REQUEST_FILENAME "!@endsWith /admin.php" \ + "id:9006900,\ + phase:1,\ + pass,\ + t:none,\ + nolog,\ + skipAfter:END-XENFORO-ADMIN" + +SecRule REQUEST_FILENAME "!@endsWith /admin.php" \ + "id:9006901,\ + phase:2,\ + pass,\ + t:none,\ + nolog,\ + skipAfter:END-XENFORO-ADMIN" + +# Admin edit user +# POST /xf/admin.php?users/the-user-name.12345/edit +SecRule REQUEST_FILENAME "@endsWith /admin.php" \ + "id:9006910,\ + phase:2,\ + pass,\ + t:none,\ + nolog,\ + chain" + SecRule REQUEST_URI "@rx /admin\.php\?users/.*\.\d+/edit$" \ + "t:none,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:profile[about],\ + ctl:ruleRemoveTargetById=931130;ARGS:profile[website]" + +# Admin save user +# POST /xf/admin.php?users/the-user-name.12345/save +SecRule REQUEST_FILENAME "@endsWith /admin.php" \ + "id:9006920,\ + phase:2,\ + pass,\ + t:none,\ + nolog,\ + chain" + SecRule REQUEST_URI "@rx /admin\.php\?users/.*\.\d+/save$" \ + "t:none,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:custom_fields[occupation],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:custom_fields[personal_quote],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:profile[about],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:profile[signature],\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:custom_fields[sexuality],\ + ctl:ruleRemoveTargetById=931130;ARGS:custom_fields[picture],\ + ctl:ruleRemoveTargetById=931130;ARGS:profile[website]" + + +# Admin edit forum notice +# POST /xf/admin.php?notices/0/save +# POST /xf/admin.php?notices/forum-name.12345/save +SecRule REQUEST_FILENAME "@endsWith /admin.php" \ + "id:9006930,\ + phase:2,\ + pass,\ + t:none,\ + nolog,\ + chain" + SecRule REQUEST_URI "@rx /admin\.php\?notices/(?:.*\.)?\d+/save$" \ + "t:none,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:message,\ + ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:title" + +# Admin batch thread update +# POST /xf/admin.php?threads/batch-update/action +SecRule REQUEST_FILENAME "@endsWith /admin.php" \ + "id:9006940,\ + phase:2,\ + pass,\ + t:none,\ + nolog,\ + chain" + SecRule REQUEST_URI "@rx /admin\.php\?threads/batch-update/action$" \ + "t:none,\ + ctl:ruleRemoveTargetById=942200;ARGS:criteria,\ + ctl:ruleRemoveTargetById=942260;ARGS:criteria,\ + ctl:ruleRemoveTargetById=942330;ARGS:criteria,\ + ctl:ruleRemoveTargetById=942340;ARGS:criteria,\ + ctl:ruleRemoveTargetById=942370;ARGS:criteria" + +# Edit forum theme +# POST /xf/admin.php?styles/title.1234/style-properties/group&group=basic +SecRule REQUEST_FILENAME "@endsWith /admin.php" \ + "id:9006950,\ + phase:2,\ + pass,\ + t:none,\ + nolog,\ + chain" + SecRule REQUEST_URI "@rx /admin\.php\?styles/" \ + "t:none,\ + ctl:ruleRemoveTargetById=942200;ARGS:json,\ + ctl:ruleRemoveTargetById=942260;ARGS:json,\ + ctl:ruleRemoveTargetById=942330;ARGS:json,\ + ctl:ruleRemoveTargetById=942340;ARGS:json,\ + ctl:ruleRemoveTargetById=942370;ARGS:json" + +SecMarker "END-XENFORO-ADMIN" + +SecMarker "END-XENFORO" diff --git a/confs/owasp-crs/REQUEST-905-COMMON-EXCEPTIONS.conf b/confs/owasp-crs/REQUEST-905-COMMON-EXCEPTIONS.conf index 3761725..812f144 100644 --- a/confs/owasp-crs/REQUEST-905-COMMON-EXCEPTIONS.conf +++ b/confs/owasp-crs/REQUEST-905-COMMON-EXCEPTIONS.conf @@ -1,5 +1,5 @@ # ------------------------------------------------------------------------ -# OWASP ModSecurity Core Rule Set ver.3.1.1 +# OWASP ModSecurity Core Rule Set ver.3.2.0 # Copyright (c) 2006-2019 Trustwave and contributors. All rights reserved. # # The OWASP ModSecurity Core Rule Set is distributed under diff --git a/confs/owasp-crs/REQUEST-910-IP-REPUTATION.conf b/confs/owasp-crs/REQUEST-910-IP-REPUTATION.conf index eadbb24..1a6e347 100644 --- a/confs/owasp-crs/REQUEST-910-IP-REPUTATION.conf +++ b/confs/owasp-crs/REQUEST-910-IP-REPUTATION.conf @@ -1,5 +1,5 @@ # ------------------------------------------------------------------------ -# OWASP ModSecurity Core Rule Set ver.3.1.1 +# OWASP ModSecurity Core Rule Set ver.3.2.0 # Copyright (c) 2006-2019 Trustwave and contributors. All rights reserved. # # The OWASP ModSecurity Core Rule Set is distributed under @@ -39,13 +39,11 @@ SecRule TX:DO_REPUT_BLOCK "@eq 1" \ tag:'platform-multi',\ tag:'attack-reputation-ip',\ tag:'IP_REPUTATION/MALICIOUS_CLIENT',\ - setvar:'tx.msg=%{rule.msg}',\ severity:'CRITICAL',\ chain,\ skipAfter:BEGIN-REQUEST-BLOCKING-EVAL" SecRule IP:REPUT_BLOCK_FLAG "@eq 1" \ - "setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-AUTOMATION/MALICIOUS-%{MATCHED_VAR_NAME}=%{MATCHED_VAR}'" + "setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # @@ -73,9 +71,7 @@ SecRule TX:HIGH_RISK_COUNTRY_CODES "!@rx ^$" \ SecRule TX:REAL_IP "@geoLookup" \ "chain" SecRule GEO:COUNTRY_CODE "@within %{tx.high_risk_country_codes}" \ - "setvar:'tx.msg=%{rule.msg}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-AUTOMATION/MALICIOUS-%{MATCHED_VAR_NAME}=%{MATCHED_VAR}',\ + "setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ setvar:'ip.reput_block_flag=1',\ setvar:'ip.reput_block_reason=%{rule.msg}',\ expirevar:'ip.reput_block_flag=%{tx.reput_block_duration}'" @@ -101,9 +97,7 @@ SecRule TX:HIGH_RISK_COUNTRY_CODES "!@rx ^$" \ # tag:'platform-multi',\ # tag:'attack-reputation-ip',\ # severity:'CRITICAL',\ -# setvar:'tx.msg=%{rule.msg}',\ # setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ -# setvar:'tx.%{rule.id}-AUTOMATION/MALICIOUS-%{MATCHED_VAR_NAME}=%{MATCHED_VAR}',\ # setvar:'ip.reput_block_flag=1',\ # setvar:'ip.reput_block_reason=%{rule.msg}',\ # expirevar:'ip.reput_block_flag=%{tx.reput_block_duration}'" @@ -185,9 +179,7 @@ SecRule TX:block_search_ip "@eq 1" \ chain,\ skipAfter:END-RBL-CHECK" SecRule TX:httpbl_msg "@rx Search Engine" \ - "setvar:'tx.msg=%{rule.msg}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-AUTOMATION/MALICIOUS-%{MATCHED_VAR_NAME}=%{MATCHED_VAR}',\ + "setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ setvar:'ip.reput_block_flag=1',\ setvar:'ip.reput_block_reason=%{rule.msg}',\ setvar:'ip.previous_rbl_check=1',\ @@ -208,9 +200,7 @@ SecRule TX:block_spammer_ip "@eq 1" \ chain,\ skipAfter:END-RBL-CHECK" SecRule TX:httpbl_msg "@rx (?i)^.*? spammer .*?$" \ - "setvar:'tx.msg=%{rule.msg}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-AUTOMATION/MALICIOUS-%{MATCHED_VAR_NAME}=%{MATCHED_VAR}',\ + "setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ setvar:'ip.reput_block_flag=1',\ setvar:'ip.reput_block_reason=%{rule.msg}',\ setvar:'ip.previous_rbl_check=1',\ @@ -231,9 +221,7 @@ SecRule TX:block_suspicious_ip "@eq 1" \ chain,\ skipAfter:END-RBL-CHECK" SecRule TX:httpbl_msg "@rx (?i)^.*? suspicious .*?$" \ - "setvar:'tx.msg=%{rule.msg}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-AUTOMATION/MALICIOUS-%{MATCHED_VAR_NAME}=%{MATCHED_VAR}',\ + "setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ setvar:'ip.reput_block_flag=1',\ setvar:'ip.reput_block_reason=%{rule.msg}',\ setvar:'ip.previous_rbl_check=1',\ @@ -254,9 +242,7 @@ SecRule TX:block_harvester_ip "@eq 1" \ chain,\ skipAfter:END-RBL-CHECK" SecRule TX:httpbl_msg "@rx (?i)^.*? harvester .*?$" \ - "setvar:'tx.msg=%{rule.msg}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-AUTOMATION/MALICIOUS-%{MATCHED_VAR_NAME}=%{MATCHED_VAR}',\ + "setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ setvar:'ip.reput_block_flag=1',\ setvar:'ip.reput_block_reason=%{rule.msg}',\ setvar:'ip.previous_rbl_check=1',\ diff --git a/confs/owasp-crs/REQUEST-911-METHOD-ENFORCEMENT.conf b/confs/owasp-crs/REQUEST-911-METHOD-ENFORCEMENT.conf index 0196990..b420cbc 100644 --- a/confs/owasp-crs/REQUEST-911-METHOD-ENFORCEMENT.conf +++ b/confs/owasp-crs/REQUEST-911-METHOD-ENFORCEMENT.conf @@ -1,5 +1,5 @@ # ------------------------------------------------------------------------ -# OWASP ModSecurity Core Rule Set ver.3.1.1 +# OWASP ModSecurity Core Rule Set ver.3.2.0 # Copyright (c) 2006-2019 Trustwave and contributors. All rights reserved. # # The OWASP ModSecurity Core Rule Set is distributed under @@ -34,16 +34,15 @@ SecRule REQUEST_METHOD "!@within %{tx.allowed_methods}" \ tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-generic',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/POLICY/METHOD_NOT_ALLOWED',\ tag:'WASCTC/WASC-15',\ tag:'OWASP_TOP_10/A6',\ tag:'OWASP_AppSensor/RE1',\ tag:'PCI/12.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - ver:'OWASP_CRS/3.1.1',\ - setvar:'tx.msg=%{rule.msg}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/POLICY/METHOD_NOT_ALLOWED-%{MATCHED_VAR_NAME}=%{MATCHED_VAR}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" diff --git a/confs/owasp-crs/REQUEST-912-DOS-PROTECTION.conf b/confs/owasp-crs/REQUEST-912-DOS-PROTECTION.conf index 4de94de..cb8521c 100644 --- a/confs/owasp-crs/REQUEST-912-DOS-PROTECTION.conf +++ b/confs/owasp-crs/REQUEST-912-DOS-PROTECTION.conf @@ -1,5 +1,5 @@ # ------------------------------------------------------------------------ -# OWASP ModSecurity Core Rule Set ver.3.1.1 +# OWASP ModSecurity Core Rule Set ver.3.2.0 # Copyright (c) 2006-2019 Trustwave and contributors. All rights reserved. # # The OWASP ModSecurity Core Rule Set is distributed under @@ -105,11 +105,11 @@ SecRule IP:DOS_BLOCK "@eq 1" \ "id:912120,\ phase:1,\ drop,\ + msg:'Denial of Service (DoS) attack identified from %{tx.real_ip} (%{tx.dos_block_counter} hits since last alert)',\ tag:'application-multi',\ tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-dos',\ - msg:'Denial of Service (DoS) attack identified from %{tx.real_ip} (%{tx.dos_block_counter} hits since last alert)',\ chain" SecRule &IP:DOS_BLOCK_FLAG "@eq 0" \ "setvar:'ip.dos_block_counter=+1',\ diff --git a/confs/owasp-crs/REQUEST-913-SCANNER-DETECTION.conf b/confs/owasp-crs/REQUEST-913-SCANNER-DETECTION.conf index d9868f0..f853417 100644 --- a/confs/owasp-crs/REQUEST-913-SCANNER-DETECTION.conf +++ b/confs/owasp-crs/REQUEST-913-SCANNER-DETECTION.conf @@ -1,5 +1,5 @@ # ------------------------------------------------------------------------ -# OWASP ModSecurity Core Rule Set ver.3.1.1 +# OWASP ModSecurity Core Rule Set ver.3.2.0 # Copyright (c) 2006-2019 Trustwave and contributors. All rights reserved. # # The OWASP ModSecurity Core Rule Set is distributed under @@ -42,20 +42,19 @@ SecRule REQUEST_HEADERS:User-Agent "@pmFromFile scanners-user-agents.data" \ tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-reputation-scanner',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/AUTOMATION/SECURITY_SCANNER',\ tag:'WASCTC/WASC-21',\ tag:'OWASP_TOP_10/A7',\ tag:'PCI/6.5.10',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/AUTOMATION/SECURITY_SCANNER-%{MATCHED_VAR_NAME}=%{MATCHED_VAR}',\ setvar:'ip.reput_block_flag=1',\ setvar:'ip.reput_block_reason=%{rule.msg}',\ expirevar:'ip.reput_block_flag=%{tx.reput_block_duration}'" -SecRule REQUEST_HEADERS_NAMES|REQUEST_HEADERS "@pmf scanners-headers.data" \ +SecRule REQUEST_HEADERS_NAMES|REQUEST_HEADERS "@pmFromFile scanners-headers.data" \ "id:913110,\ phase:2,\ block,\ @@ -67,22 +66,21 @@ SecRule REQUEST_HEADERS_NAMES|REQUEST_HEADERS "@pmf scanners-headers.data" \ tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-reputation-scanner',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/AUTOMATION/SECURITY_SCANNER',\ tag:'WASCTC/WASC-21',\ tag:'OWASP_TOP_10/A7',\ tag:'PCI/6.5.10',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/AUTOMATION/SECURITY_SCANNER-%{MATCHED_VAR_NAME}=%{MATCHED_VAR}',\ setvar:'ip.reput_block_flag=1',\ setvar:'ip.reput_block_reason=%{rule.msg}',\ expirevar:'ip.reput_block_flag=%{tx.reput_block_duration}'" -SecRule REQUEST_FILENAME|ARGS "@pmf scanners-urls.data" \ +SecRule REQUEST_FILENAME|ARGS "@pmFromFile scanners-urls.data" \ "id:913120,\ phase:2,\ block,\ @@ -94,15 +92,14 @@ SecRule REQUEST_FILENAME|ARGS "@pmf scanners-urls.data" \ tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-reputation-scanner',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/AUTOMATION/SECURITY_SCANNER',\ tag:'WASCTC/WASC-21',\ tag:'OWASP_TOP_10/A7',\ tag:'PCI/6.5.10',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/AUTOMATION/SECURITY_SCANNER-%{MATCHED_VAR_NAME}=%{MATCHED_VAR}',\ setvar:'ip.reput_block_flag=1',\ setvar:'ip.reput_block_reason=%{rule.msg}',\ expirevar:'ip.reput_block_flag=%{tx.reput_block_duration}'" @@ -136,16 +133,15 @@ SecRule REQUEST_HEADERS:User-Agent "@pmFromFile scripting-user-agents.data" \ tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-reputation-scripting',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/AUTOMATION/SCRIPTING',\ tag:'WASCTC/WASC-21',\ tag:'OWASP_TOP_10/A7',\ tag:'PCI/6.5.10',\ tag:'paranoia-level/2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/AUTOMATION/SCRIPTING-%{MATCHED_VAR_NAME}=%{MATCHED_VAR}',\ setvar:'ip.reput_block_flag=1',\ setvar:'ip.reput_block_reason=%{rule.msg}',\ expirevar:'ip.reput_block_flag=%{tx.reput_block_duration}'" @@ -173,16 +169,15 @@ SecRule REQUEST_HEADERS:User-Agent "@pmFromFile crawlers-user-agents.data" \ tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-reputation-crawler',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/AUTOMATION/CRAWLER',\ tag:'WASCTC/WASC-21',\ tag:'OWASP_TOP_10/A7',\ tag:'PCI/6.5.10',\ tag:'paranoia-level/2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/AUTOMATION/CRAWLER-%{MATCHED_VAR_NAME}=%{MATCHED_VAR}',\ setvar:'ip.reput_block_flag=1',\ setvar:'ip.reput_block_reason=%{rule.msg}',\ expirevar:'ip.reput_block_flag=%{tx.reput_block_duration}'" diff --git a/confs/owasp-crs/REQUEST-920-PROTOCOL-ENFORCEMENT.conf b/confs/owasp-crs/REQUEST-920-PROTOCOL-ENFORCEMENT.conf index 8cf817c..8f03164 100644 --- a/confs/owasp-crs/REQUEST-920-PROTOCOL-ENFORCEMENT.conf +++ b/confs/owasp-crs/REQUEST-920-PROTOCOL-ENFORCEMENT.conf @@ -1,5 +1,5 @@ # ------------------------------------------------------------------------ -# OWASP ModSecurity Core Rule Set ver.3.1.1 +# OWASP ModSecurity Core Rule Set ver.3.2.0 # Copyright (c) 2006-2019 Trustwave and contributors. All rights reserved. # # The OWASP ModSecurity Core Rule Set is distributed under @@ -55,13 +55,12 @@ SecRule REQUEST_LINE "!@rx ^(?i:(?:[a-z]{3,10}\s+(?:\w{3,7}?://[\w\-\./]*(?::\d+ tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-protocol',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ',\ tag:'CAPEC-272',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'WARNING',\ - setvar:'tx.msg=%{rule.msg}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.notice_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ-%{MATCHED_VAR_NAME}=%{MATCHED_VAR}'" + setvar:'tx.anomaly_score_pl1=+%{tx.notice_anomaly_score}'" # @@ -90,6 +89,8 @@ SecRule REQUEST_LINE "!@rx ^(?i:(?:[a-z]{3,10}\s+(?:\w{3,7}?://[\w\-\./]*(?::\d+ # 920121: PL2 : FILES_NAMES, FILES # ['\";=] : ' " ; = meta-characters # +# Not supported by re2 (?( # Anatomy of the regexp with examples of patterns caught: @@ -108,17 +111,16 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-shell',\ tag:'platform-unix',\ tag:'attack-rce',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',\ tag:'WASCTC/WASC-31',\ tag:'OWASP_TOP_10/A1',\ tag:'PCI/6.5.2',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/RCE-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # Apache 2.2 requires configuration file lines to be under 8kB. # Therefore, some remaining commands have been split off to a separate rule. @@ -146,17 +148,16 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-shell',\ tag:'platform-unix',\ tag:'attack-rce',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',\ tag:'WASCTC/WASC-31',\ tag:'OWASP_TOP_10/A1',\ tag:'PCI/6.5.2',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/RCE-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # [ Windows command injection ] @@ -245,22 +246,24 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-shell',\ tag:'platform-windows',\ tag:'attack-rce',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',\ tag:'WASCTC/WASC-31',\ tag:'OWASP_TOP_10/A1',\ tag:'PCI/6.5.2',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/RCE-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # Apache 2.2 requires configuration file lines to be under 8kB. # Therefore, some remaining commands have been split off to a separate rule. # For explanation of this rule, see rule 932110. # +# This rule is also triggered by an Oracle WebLogic Remote Command Execution exploit: +# [ Oracle WebLogic vulnerability CVE-2017-10271 - Exploit tested: https://www.exploit-db.com/exploits/43458 ] +# # To rebuild the word list regexp: # cd util/regexp-assemble # cat regexp-932115.txt | ./regexp-cmdline.py windows | ./regexp-assemble.pl @@ -283,17 +286,16 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-shell',\ tag:'platform-windows',\ tag:'attack-rce',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',\ tag:'WASCTC/WASC-31',\ tag:'OWASP_TOP_10/A1',\ tag:'PCI/6.5.2',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/RCE-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # [ Windows PowerShell, cmdlets and options ] @@ -307,7 +309,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME # https://technet.microsoft.com/en-us/magazine/ff714569.aspx # https://msdn.microsoft.com/en-us/powershell/scripting/core-powershell/console/powershell.exe-command-line-help # -SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@pmf windows-powershell-commands.data" \ +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@pmFromFile windows-powershell-commands.data" \ "id:932120,\ phase:2,\ block,\ @@ -320,17 +322,16 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-powershell',\ tag:'platform-windows',\ tag:'attack-rce',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',\ tag:'WASCTC/WASC-31',\ tag:'OWASP_TOP_10/A1',\ tag:'PCI/6.5.2',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/RCE-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # [ Unix shell expressions ] @@ -345,7 +346,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME # $((foo)) Arithmetic expansion # # Regexp generated from util/regexp-assemble/regexp-932130.data using Regexp::Assemble. -# See http://blog.modsecurity.org/2007/06/optimizing-regu.html for usage. +# See https://coreruleset.org/20190826/optimizing-regular-expressions/ for usage. # SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?:\$(?:\((?:\(.*\)|.*)\)|\{.*\})|[<>]\(.*\))" \ "id:932130,\ @@ -359,17 +360,16 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-shell',\ tag:'platform-unix',\ tag:'attack-rce',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',\ tag:'WASCTC/WASC-31',\ tag:'OWASP_TOP_10/A1',\ tag:'PCI/6.5.2',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/RCE-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # [ Windows FOR, IF commands ] @@ -393,9 +393,9 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME # http://ss64.com/nt/for.html # # Regexp generated from util/regexp-assemble/regexp-932140.data using Regexp::Assemble. -# See http://blog.modsecurity.org/2007/06/optimizing-regu.html for usage. +# See https://coreruleset.org/20190826/optimizing-regular-expressions/ for usage. # -SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx \b(?:if(?:/i)?(?: not)?(?: exist\b| defined\b| errorlevel\b| cmdextversion\b|(?: |\().*(?:\bgeq\b|\bequ\b|\bneq\b|\bleq\b|\bgtr\b|\blss\b|==))|for(/[dflr].*)* %+[^ ]+ in\(.*\)\s?do)" \ +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx \b(?:if(?:/i)?(?: not)?(?: exist\b| defined\b| errorlevel\b| cmdextversion\b|(?: |\().*(?:\bgeq\b|\bequ\b|\bneq\b|\bleq\b|\bgtr\b|\blss\b|==))|for(?:/[dflr].*)? %+[^ ]+ in\(.*\)\s?do)" \ "id:932140,\ phase:2,\ block,\ @@ -407,17 +407,16 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-shell',\ tag:'platform-windows',\ tag:'attack-rce',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',\ tag:'WASCTC/WASC-31',\ tag:'OWASP_TOP_10/A1',\ tag:'PCI/6.5.2',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/RCE-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # [ Unix direct remote command execution ] @@ -429,6 +428,9 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME # command string is appended (injected) to a regular parameter, and then # passed to a shell unescaped. # +# This rule is also triggered by an Oracle WebLogic Remote Command Execution exploit: +# [ Oracle WebLogic vulnerability CVE-2017-10271 - Exploit tested: https://www.exploit-db.com/exploits/43458 ] +# # Due to a higher risk of false positives, the following changes have been # made relative to rule 932100: # 1) the set of commands is smaller @@ -457,17 +459,16 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-shell',\ tag:'platform-unix',\ tag:'attack-rce',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',\ tag:'WASCTC/WASC-31',\ tag:'OWASP_TOP_10/A1',\ tag:'PCI/6.5.2',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/RCE-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # [ Unix shell snippets ] @@ -478,7 +479,13 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME # have been added here with their full path, in order to catch some # cases where the full path is sent. # -SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@pmf unix-shell.data" \ +# This rule is also triggered by an Apache Struts Remote Code Execution exploit: +# [ Apache Struts vulnerability CVE-2017-9805 - Exploit tested: https://www.exploit-db.com/exploits/42627 ] +# +# This rule is also triggered by an Oracle WebLogic Remote Command Execution exploit: +# [ Oracle WebLogic vulnerability CVE-2017-10271 - Exploit tested: https://www.exploit-db.com/exploits/43458 ] + +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@pmFromFile unix-shell.data" \ "id:932160,\ phase:2,\ block,\ @@ -490,17 +497,16 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-shell',\ tag:'platform-unix',\ tag:'attack-rce',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',\ tag:'WASCTC/WASC-31',\ tag:'OWASP_TOP_10/A1',\ tag:'PCI/6.5.2',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/RCE-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # [ Shellshock vulnerability (CVE-2014-6271 and CVE-2014-7169) ] @@ -524,17 +530,16 @@ SecRule REQUEST_HEADERS|REQUEST_LINE "@rx ^\(\s*\)\s+{" \ tag:'language-shell',\ tag:'platform-unix',\ tag:'attack-rce',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',\ tag:'WASCTC/WASC-31',\ tag:'OWASP_TOP_10/A1',\ tag:'PCI/6.5.2',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/RCE-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" SecRule ARGS_NAMES|ARGS|FILES_NAMES "@rx ^\(\s*\)\s+{" \ "id:932171,\ @@ -548,17 +553,16 @@ SecRule ARGS_NAMES|ARGS|FILES_NAMES "@rx ^\(\s*\)\s+{" \ tag:'language-shell',\ tag:'platform-unix',\ tag:'attack-rce',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',\ tag:'WASCTC/WASC-31',\ tag:'OWASP_TOP_10/A1',\ tag:'PCI/6.5.2',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/RCE-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # @@ -574,28 +578,27 @@ SecRule ARGS_NAMES|ARGS|FILES_NAMES "@rx ^\(\s*\)\s+{" \ # code execution. # SecRule FILES|REQUEST_HEADERS:X-Filename|REQUEST_HEADERS:X_Filename|REQUEST_HEADERS:X-File-Name \ - "@pmf restricted-upload.data" \ + "@pmFromFile restricted-upload.data" \ "id:932180,\ phase:2,\ block,\ capture,\ t:none,t:lowercase,\ - logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\ msg:'Restricted File Upload Attempt',\ + logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\ tag:'application-multi',\ tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-rce',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',\ tag:'WASCTC/WASC-31',\ tag:'OWASP_TOP_10/A1',\ tag:'PCI/6.5.2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.lfi_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/FILE_INJECTION-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 2" "id:932013,phase:1,pass,nolog,skipAfter:END-REQUEST-932-APPLICATION-ATTACK-RCE" @@ -642,18 +645,17 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-shell',\ tag:'platform-unix',\ tag:'attack-rce',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',\ tag:'WASCTC/WASC-31',\ tag:'OWASP_TOP_10/A1',\ tag:'PCI/6.5.2',\ tag:'paranoia-level/3',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl3=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/RCE-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl3=+%{tx.critical_anomaly_score}'" # # -=[ Bypass Rule 930120 (wildcard) ]=- @@ -677,6 +679,7 @@ SecRule ARGS "@rx (?:/|\\\\)(?:[\?\*]+[a-z/\\\\]+|[a-z/\\\\]+[\?\*]+)" \ tag:'language-shell',\ tag:'platform-unix',\ tag:'attack-rce',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',\ tag:'WASCTC/WASC-31',\ tag:'OWASP_TOP_10/A1',\ @@ -684,10 +687,8 @@ SecRule ARGS "@rx (?:/|\\\\)(?:[\?\*]+[a-z/\\\\]+|[a-z/\\\\]+[\?\*]+)" \ tag:'paranoia-level/3',\ ctl:auditLogParts=+E,\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl3=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/RCE-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl3=+%{tx.critical_anomaly_score}'" SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 4" "id:932017,phase:1,pass,nolog,skipAfter:END-REQUEST-932-APPLICATION-ATTACK-RCE" SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 4" "id:932018,phase:2,pass,nolog,skipAfter:END-REQUEST-932-APPLICATION-ATTACK-RCE" diff --git a/confs/owasp-crs/REQUEST-933-APPLICATION-ATTACK-PHP.conf b/confs/owasp-crs/REQUEST-933-APPLICATION-ATTACK-PHP.conf index 63d3a32..9c124b9 100644 --- a/confs/owasp-crs/REQUEST-933-APPLICATION-ATTACK-PHP.conf +++ b/confs/owasp-crs/REQUEST-933-APPLICATION-ATTACK-PHP.conf @@ -1,5 +1,5 @@ # ------------------------------------------------------------------------ -# OWASP ModSecurity Core Rule Set ver.3.1.1 +# OWASP ModSecurity Core Rule Set ver.3.2.0 # Copyright (c) 2006-2019 Trustwave and contributors. All rights reserved. # # The OWASP ModSecurity Core Rule Set is distributed under @@ -43,6 +43,8 @@ SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 1" "id:933012,phase:2,pass,nolog,skipAf # Therefore, that pattern is now checked by rule 933190 in paranoia levels # 3 or higher. # +# Not supported by re2 (?!re). +# SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?:<\?(?!xml\s)|<\?php|\[(?:/|\\\\)?php\])" \ "id:933100,\ phase:2,\ @@ -55,15 +57,14 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-php',\ tag:'platform-multi',\ tag:'attack-injection-php',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/PHP_INJECTION',\ tag:'OWASP_TOP_10/A1',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/PHP_INJECTION-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # # [ PHP Script Uploads ] @@ -86,7 +87,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME # X_Filename, or X-File-Name to transmit the file name to the server; # scan these request headers as well as multipart/form-data file names. # -SecRule FILES|REQUEST_HEADERS:X-Filename|REQUEST_HEADERS:X_Filename|REQUEST_HEADERS:X-File-Name "@rx .*\.(?:php\d*|phtml)\.*$" \ +SecRule FILES|REQUEST_HEADERS:X-Filename|REQUEST_HEADERS:X_Filename|REQUEST_HEADERS:X.Filename|REQUEST_HEADERS:X-File-Name "@rx .*\.(?:php\d*|phtml)\.*$" \ "id:933110,\ phase:2,\ block,\ @@ -98,21 +99,20 @@ SecRule FILES|REQUEST_HEADERS:X-Filename|REQUEST_HEADERS:X_Filename|REQUEST_HEAD tag:'language-php',\ tag:'platform-multi',\ tag:'attack-injection-php',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/PHP_INJECTION',\ tag:'OWASP_TOP_10/A1',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/PHP_INJECTION-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # # [ PHP Configuration Directives ] # -SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@pmf php-config-directives.data" \ +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@pmFromFile php-config-directives.data" \ "id:933120,\ phase:2,\ block,\ @@ -124,24 +124,23 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-php',\ tag:'platform-multi',\ tag:'attack-injection-php',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/PHP_INJECTION',\ tag:'OWASP_TOP_10/A1',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ chain" SecRule MATCHED_VARS "@pm =" \ "capture,\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/PHP_INJECTION-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # # [ PHP Variables ] # -SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@pmf php-variables.data" \ +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@pmFromFile php-variables.data" \ "id:933130,\ phase:2,\ block,\ @@ -153,15 +152,14 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-php',\ tag:'platform-multi',\ tag:'attack-injection-php',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/PHP_INJECTION',\ tag:'OWASP_TOP_10/A1',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/PHP_INJECTION-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # @@ -191,15 +189,43 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-php',\ tag:'platform-multi',\ tag:'attack-injection-php',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/PHP_INJECTION',\ tag:'OWASP_TOP_10/A1',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/PHP_INJECTION-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" + + +# +# [ PHP Wrappers ] +# +# PHP comes with many built-in wrappers for various URL-style protocols for use with the filesystem +# functions such as fopen(), copy(), file_exists() and filesize(). Abusing of PHP wrappers like phar:// +# could lead to RCE as describled by Sam Thomas at BlackHat USA 2018 (https://bit.ly/2yaKV5X), even +# wrappers like zlib://, glob://, rar://, zip://, etc... could lead to LFI and expect:// to RCE. +# +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:zlib|glob|phar|ssh2|rar|ogg|expect|zip)://" \ + "id:933200,\ + phase:2,\ + block,\ + t:none,t:utf8toUnicode,t:urlDecodeUni,t:removeNulls,t:cmdLine,\ + msg:'PHP Injection Attack: Wrapper scheme detected',\ + logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\ + tag:'application-multi',\ + tag:'language-php',\ + tag:'platform-multi',\ + tag:'attack-injection-php',\ + tag:'OWASP_CRS',\ + tag:'OWASP_CRS/WEB_ATTACK/PHP_INJECTION',\ + tag:'OWASP_TOP_10/A1',\ + ctl:auditLogParts=+E,\ + ver:'OWASP_CRS/3.2.0',\ + severity:'CRITICAL',\ + setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\ + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # @@ -215,7 +241,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME # - Rule 933150: ~40 words highly common to PHP injection payloads and extremely rare in # natural language or other contexts. # Examples: 'base64_decode', 'file_get_contents'. -# These words are detected as a match directly using @pmf. +# These words are detected as a match directly using @pmFromFile. # Function names are defined in php-function-names-933150.data # # - Rule 933160: ~220 words which are common in PHP code, but have a higher chance to cause @@ -226,7 +252,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME # # - Rule 933151: ~1300 words of lesser importance. This includes most PHP functions and keywords. # Examples: 'addslashes', 'array_diff'. -# For performance reasons, the @pmf operator is used, and many functions from lesser +# For performance reasons, the @pmFromFile operator is used, and many functions from lesser # used PHP extensions are removed. # To mitigate false positives, we only match when the '(' character is also found. # This rule only runs in paranoia level 2 or higher. @@ -248,7 +274,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME # We block these function names outright, without using a complex regexp or chain. # This could make the detection a bit more robust against possible bypasses. # -SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "@pmf php-function-names-933150.data" \ +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "@pmFromFile php-function-names-933150.data" \ "id:933150,\ phase:2,\ block,\ @@ -260,15 +286,14 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_F tag:'language-php',\ tag:'platform-multi',\ tag:'attack-injection-php',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/PHP_INJECTION',\ tag:'OWASP_TOP_10/A1',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/PHP_INJECTION-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # @@ -292,8 +317,14 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_F # system //comment \n (...) # system #comment \n (...) # +# This rule is also triggered by the following exploit(s): +# [ Apache Struts vulnerability CVE-2017-9791 - Exploit tested: https://www.exploit-db.com/exploits/42324 ] +# [ Apache Struts vulnerability CVE-2018-11776 - Exploit tested: https://www.exploit-db.com/exploits/45260 ] +# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ] +# # Regexp generated from util/regexp-assemble/regexp-933160.data using Regexp::Assemble. -# See http://blog.modsecurity.org/2007/06/optimizing-regu.html for usage. +# See https://coreruleset.org/20190826/optimizing-regular-expressions/ for usage. +# # Note that after assemble, PHP function syntax pre/postfix is added to the Regexp::Assemble # output. Example: "@rx (?i)\bASSEMBLE_OUTPUT_HERE(?:\s|/\*.*\*/|//.*|#.*)*\(.*\)" # @@ -309,15 +340,14 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_F tag:'language-php',\ tag:'platform-multi',\ tag:'attack-injection-php',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/PHP_INJECTION',\ tag:'OWASP_TOP_10/A1',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/PHP_INJECTION-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # @@ -366,15 +396,14 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_H tag:'language-php',\ tag:'platform-multi',\ tag:'attack-injection-php',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/PHP_INJECTION',\ tag:'OWASP_TOP_10/A1',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/PHP_INJECTION-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" @@ -423,16 +452,56 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_F tag:'language-php',\ tag:'platform-multi',\ tag:'attack-injection-php',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/PHP_INJECTION',\ tag:'OWASP_TOP_10/A1',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/PHP_INJECTION-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" +# [ PHP Functions: Variable Function Prevent Bypass ] +# +# Referring to https://www.secjuice.com/php-rce-bypass-filters-sanitization-waf/ +# the rule 933180 could be bypassed by using the following payloads: +# +# - (system)('uname') +# - (sy.(st).em)('uname') +# - (string)"system"('uname') +# - define('x', 'sys' . 'tem');(x)/* comment */('uname') +# - $y = 'sys'.'tem';($y)('uname') +# - define('z', [['sys' .'tem']]);(z)[0][0]('uname'); +# - (system)(ls) +# - (/**/system)(ls/**/); +# - (['system'])[0]('uname'); +# - (++[++system++][++0++])++{/*dsasd*/0}++(++ls++); +# +# This rule blocks all payloads above and avoids to block values like: +# +# - [ACME] this is a test (just a test) +# - Test (with two) rounded (brackets) +# +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "@rx (?:(?:\(|\[)[a-zA-Z0-9_.$\"'\[\](){}/*\s]+(?:\)|\])[0-9_.$\"'\[\](){}/*\s]*\([a-zA-Z0-9_.$\"'\[\](){}/*\s].*\)|\([\s]*string[\s]*\)[\s]*(?:\"|'))" \ + "id:933210,\ + phase:2,\ + block,\ + capture,\ + t:none,t:urlDecode,t:replaceComments,t:compressWhitespace,\ + msg:'PHP Injection Attack: Variable Function Call Found',\ + logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\ + tag:'application-multi',\ + tag:'language-php',\ + tag:'platform-multi',\ + tag:'attack-injection-php',\ + tag:'OWASP_CRS',\ + tag:'OWASP_CRS/WEB_ATTACK/PHP_INJECTION',\ + tag:'OWASP_TOP_10/A1',\ + ctl:auditLogParts=+E,\ + ver:'OWASP_CRS/3.2.0',\ + severity:'CRITICAL',\ + setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\ + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 2" "id:933013,phase:1,pass,nolog,skipAfter:END-REQUEST-933-APPLICATION-ATTACK-PHP" SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 2" "id:933014,phase:2,pass,nolog,skipAfter:END-REQUEST-933-APPLICATION-ATTACK-PHP" @@ -448,7 +517,7 @@ SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 2" "id:933014,phase:2,pass,nolog,skipAf # The size of the PHP function list is considerable. # Even after excluding the more obscure PHP extensions, 1300+ functions remain. # For performance and maintenance reasons, this rule does not use a regexp, -# but uses a phrase file (@pmf), and additionally looks for an '(' character +# but uses a phrase file (@pmFromFile), and additionally looks for an '(' character # in the matched variable. # # This approach carries some risk for false positives. Therefore, the function list @@ -457,7 +526,7 @@ SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 2" "id:933014,phase:2,pass,nolog,skipAf # # This rule is a stricter sibling of rule 933150. # -SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "@pmf php-function-names-933151.data" \ +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "@pmFromFile php-function-names-933151.data" \ "id:933151,\ phase:2,\ block,\ @@ -469,19 +538,18 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_F tag:'language-php',\ tag:'platform-multi',\ tag:'attack-injection-php',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/PHP_INJECTION',\ tag:'OWASP_TOP_10/A1',\ tag:'paranoia-level/2',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ chain" SecRule MATCHED_VARS "@pm (" \ "capture,\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/PHP_INJECTION-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'" @@ -506,7 +574,7 @@ SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 3" "id:933016,phase:2,pass,nolog,skipAf # parameter names or values and this will lead to false positives. # Because this list is not expected to change and it is limited in size we use a # regex in this case to look for these values whereas in its sibling rule we use -# @pmf for flexibility and performance. +# @pmFromFile for flexibility and performance. # # To rebuild the regexp: # cd util/regexp-assemble @@ -525,16 +593,15 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-php',\ tag:'platform-multi',\ tag:'attack-injection-php',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/PHP_INJECTION',\ tag:'OWASP_TOP_10/A1',\ tag:'paranoia-level/3',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl3=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/PHP_INJECTION-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl3=+%{tx.critical_anomaly_score}'" # @@ -551,8 +618,13 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME # # This rule is a stricter sibling of rule 933160. # +# This rule is also triggered by the following exploit(s): +# [ Apache Struts vulnerability CVE-2018-11776 - Exploit tested: https://www.exploit-db.com/exploits/45262 ] +# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ] +# # Regexp generated from util/regexp-assemble/regexp-933161.data using Regexp::Assemble. -# See http://blog.modsecurity.org/2007/06/optimizing-regu.html for usage. +# See https://coreruleset.org/20190826/optimizing-regular-expressions/ for usage. +# # Note that after assemble, PHP function syntax pre/postfix is added to the Regexp::Assemble # output. Example: "@rx (?i)\bASSEMBLE_OUTPUT_HERE(?:\s|/\*.*\*/|//.*|#.*)*\(.*\)" # @@ -568,16 +640,15 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_F tag:'language-php',\ tag:'platform-multi',\ tag:'attack-injection-php',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/PHP_INJECTION',\ tag:'OWASP_TOP_10/A1',\ tag:'paranoia-level/3',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl3=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/PHP_INJECTION-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl3=+%{tx.critical_anomaly_score}'" # @@ -601,7 +672,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_F # # This rule is a stricter sibling of rule 933110. # -SecRule FILES|REQUEST_HEADERS:X-Filename|REQUEST_HEADERS:X_Filename|REQUEST_HEADERS:X-File-Name "@rx .*\.(?:php\d*|phtml)\..*$" \ +SecRule FILES|REQUEST_HEADERS:X-Filename|REQUEST_HEADERS:X_Filename|REQUEST_HEADERS:X.Filename|REQUEST_HEADERS:X-File-Name "@rx .*\.(?:php\d*|phtml)\..*$" \ "id:933111,\ phase:2,\ block,\ @@ -613,16 +684,15 @@ SecRule FILES|REQUEST_HEADERS:X-Filename|REQUEST_HEADERS:X_Filename|REQUEST_HEAD tag:'language-php',\ tag:'platform-multi',\ tag:'attack-injection-php',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/PHP_INJECTION',\ tag:'OWASP_TOP_10/A1',\ tag:'paranoia-level/3',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl3=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/PHP_INJECTION-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl3=+%{tx.critical_anomaly_score}'" # [ PHP Closing Tag Found ] @@ -634,27 +704,26 @@ SecRule FILES|REQUEST_HEADERS:X-Filename|REQUEST_HEADERS:X_Filename|REQUEST_HEAD # See issue #654 for discussion. # SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@pm ?>" \ - "msg:'PHP Injection Attack: PHP Closing Tag Found',\ + "id:933190,\ phase:2,\ - ver:'OWASP_CRS/3.1.1',\ - t:none,t:urlDecodeUni,\ - ctl:auditLogParts=+E,\ block,\ capture,\ + t:none,t:urlDecodeUni,\ + msg:'PHP Injection Attack: PHP Closing Tag Found',\ logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\ - id:933190,\ - severity:'CRITICAL',\ tag:'application-multi',\ tag:'language-php',\ tag:'platform-multi',\ tag:'attack-injection-php',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/PHP_INJECTION',\ tag:'OWASP_TOP_10/A1',\ tag:'paranoia-level/3',\ - setvar:'tx.msg=%{rule.msg}',\ + ctl:auditLogParts=+E,\ + ver:'OWASP_CRS/3.2.0',\ + severity:'CRITICAL',\ setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl3=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/PHP_INJECTION-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl3=+%{tx.critical_anomaly_score}'" SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 4" "id:933017,phase:1,pass,nolog,skipAfter:END-REQUEST-933-APPLICATION-ATTACK-PHP" diff --git a/confs/owasp-crs/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf b/confs/owasp-crs/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf new file mode 100644 index 0000000..b136626 --- /dev/null +++ b/confs/owasp-crs/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf @@ -0,0 +1,94 @@ +# ------------------------------------------------------------------------ +# OWASP ModSecurity Core Rule Set ver.3.2.0 +# Copyright (c) 2006-2019 Trustwave and contributors. All rights reserved. +# +# The OWASP ModSecurity Core Rule Set is distributed under +# Apache Software License (ASL) version 2 +# Please see the enclosed LICENSE file for full details. +# ------------------------------------------------------------------------ + +# +# -= Paranoia Level 0 (empty) =- (apply unconditionally) +# + + + +SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 1" "id:934011,phase:1,pass,nolog,skipAfter:END-REQUEST-934-APPLICATION-ATTACK-NODEJS" +SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 1" "id:934012,phase:2,pass,nolog,skipAfter:END-REQUEST-934-APPLICATION-ATTACK-NODEJS" +# +# -= Paranoia Level 1 (default) =- (apply only when tx.executing_paranoia_level is sufficiently high: 1 or higher) +# + + +# [ Insecure unserialization / generic RCE signatures ] +# +# Libraries performing insecure unserialization: +# - node-serialize: _$$ND_FUNC$$_ (CVE-2017-5941) +# - funcster: __js_function +# +# See: +# https://opsecx.com/index.php/2017/02/08/exploiting-node-js-deserialization-bug-for-remote-code-execution/ +# https://www.acunetix.com/blog/web-security-zone/deserialization-vulnerabilities-attacking-deserialization-in-js/ +# +# Some generic snippets used: +# - function() { +# - new Function( +# - eval( +# - String.fromCharCode( +# +# Last two are used by nodejsshell.py, +# https://github.com/ajinabraham/Node.Js-Security-Course/blob/master/nodejsshell.py +# +# As base64 is sometimes (but not always) used to encode serialized values, +# use multiMatch and t:base64decode. +# +# Regexp generated from util/regexp-assemble/regexp-934100.data using Regexp::Assemble. +# See https://coreruleset.org/20190826/optimizing-regular-expressions/ for usage. + +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?:(?:_(?:\$\$ND_FUNC\$\$_|_js_function)|(?:new\s+Function|\beval)\s*\(|String\s*\.\s*fromCharCode|function\s*\(\s*\)\s*{|this\.constructor)|module\.exports\s*=)" \ + "id:934100,\ + phase:2,\ + block,\ + capture,\ + t:none,t:urlDecodeUni,t:base64Decode,\ + msg:'Node.js Injection Attack',\ + logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\ + tag:'application-multi',\ + tag:'language-javascript',\ + tag:'platform-multi',\ + tag:'attack-rce',\ + tag:'attack-injection-nodejs',\ + tag:'OWASP_CRS/WEB_ATTACK/NODEJS_INJECTION',\ + tag:'OWASP_TOP_10/A1',\ + ctl:auditLogParts=+E,\ + ver:'OWASP_CRS/3.2.0',\ + severity:'CRITICAL',\ + multiMatch,\ + setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\ + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" + + +SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 2" "id:934013,phase:1,pass,nolog,skipAfter:END-REQUEST-934-APPLICATION-ATTACK-NODEJS" +SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 2" "id:934014,phase:2,pass,nolog,skipAfter:END-REQUEST-934-APPLICATION-ATTACK-NODEJS" +# +# -= Paranoia Level 2 =- (apply only when tx.executing_paranoia_level is sufficiently high: 2 or higher) +# + +SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 3" "id:934015,phase:1,pass,nolog,skipAfter:END-REQUEST-934-APPLICATION-ATTACK-NODEJS" +SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 3" "id:934016,phase:2,pass,nolog,skipAfter:END-REQUEST-934-APPLICATION-ATTACK-NODEJS" +# +# -= Paranoia Level 3 =- (apply only when tx.executing_paranoia_level is sufficiently high: 3 or higher) +# + +SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 4" "id:934017,phase:1,pass,nolog,skipAfter:END-REQUEST-934-APPLICATION-ATTACK-NODEJS" +SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 4" "id:934018,phase:2,pass,nolog,skipAfter:END-REQUEST-934-APPLICATION-ATTACK-NODEJS" +# +# -= Paranoia Level 4 =- (apply only when tx.executing_paranoia_level is sufficiently high: 4 or higher) +# + + + +# +# -= Paranoia Levels Finished =- +# +SecMarker "END-REQUEST-934-APPLICATION-ATTACK-NODEJS" diff --git a/confs/owasp-crs/REQUEST-941-APPLICATION-ATTACK-XSS.conf b/confs/owasp-crs/REQUEST-941-APPLICATION-ATTACK-XSS.conf index c09a258..a106036 100644 --- a/confs/owasp-crs/REQUEST-941-APPLICATION-ATTACK-XSS.conf +++ b/confs/owasp-crs/REQUEST-941-APPLICATION-ATTACK-XSS.conf @@ -1,5 +1,5 @@ # ------------------------------------------------------------------------ -# OWASP ModSecurity Core Rule Set ver.3.1.1 +# OWASP ModSecurity Core Rule Set ver.3.2.0 # Copyright (c) 2006-2019 Trustwave and contributors. All rights reserved. # # The OWASP ModSecurity Core Rule Set is distributed under @@ -45,6 +45,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_H tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-xss',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/XSS',\ tag:'WASCTC/WASC-8',\ tag:'WASCTC/WASC-22',\ @@ -52,12 +53,10 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_H tag:'OWASP_AppSensor/IE1',\ tag:'CAPEC-242',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/XSS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # @@ -65,7 +64,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_H # http://xssplayground.net23.net/xssfilter.html # script tag based XSS vectors, e.g., # -SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|REQUEST_HEADERS:Referer|ARGS_NAMES|ARGS|XML:/* "@rx (?i)[<＜]script[^>＞]*[>＞][\s\S]*?" \ +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|REQUEST_HEADERS:User-Agent|REQUEST_HEADERS:Referer|ARGS_NAMES|ARGS|XML:/* "@rx (?i)]*>[\s\S]*?" \ "id:941110,\ phase:2,\ block,\ @@ -77,6 +76,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_H tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-xss',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/XSS',\ tag:'WASCTC/WASC-8',\ tag:'WASCTC/WASC-22',\ @@ -84,12 +84,10 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_H tag:'OWASP_AppSensor/IE1',\ tag:'CAPEC-242',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/XSS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # @@ -108,6 +106,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_H tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-xss',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/XSS',\ tag:'WASCTC/WASC-8',\ tag:'WASCTC/WASC-22',\ @@ -115,18 +114,16 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_H tag:'OWASP_AppSensor/IE1',\ tag:'CAPEC-242',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/XSS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # # -=[ XSS Filters - Category 3 ]=- # -SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|ARGS_NAMES|ARGS|XML:/* "@rx (?i)[\s\S](?:x(?:link:href|html|mlns)|!ENTITY.*?SYSTEM|data:text\/html|pattern(?=.*?=)|formaction|\@import|base64)\b" \ +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|ARGS_NAMES|ARGS|XML:/* "@rx (?i)[\s\S]((?:x(?:link:href|html|mlns)|!ENTITY.*?(?:SYSTEM|PUBLIC)|data:text\/html|formaction|\@import|base64)\b|pattern\b.*?=)" \ "id:941130,\ phase:2,\ block,\ @@ -138,6 +135,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_H tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-xss',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/XSS',\ tag:'WASCTC/WASC-8',\ tag:'WASCTC/WASC-22',\ @@ -145,12 +143,10 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_H tag:'OWASP_AppSensor/IE1',\ tag:'CAPEC-242',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/XSS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # @@ -169,6 +165,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_H tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-xss',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/XSS',\ tag:'WASCTC/WASC-8',\ tag:'WASCTC/WASC-22',\ @@ -176,12 +173,10 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_H tag:'OWASP_AppSensor/IE1',\ tag:'CAPEC-242',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/XSS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # @@ -190,7 +185,14 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_H # # [NoScript InjectionChecker] HTML injection # -SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|REQUEST_HEADERS:Referer|ARGS_NAMES|ARGS|XML:/* "@rx (?i)<[^\w<>]*(?:[^<>\"'\s]*:)?[^\w<>]*(?:\W*?s\W*?c\W*?r\W*?i\W*?p\W*?t|\W*?f\W*?o\W*?r\W*?m|\W*?s\W*?t\W*?y\W*?l\W*?e|\W*?s\W*?v\W*?g|\W*?m\W*?a\W*?r\W*?q\W*?u\W*?e\W*?e|(?:\W*?l\W*?i\W*?n\W*?k|\W*?o\W*?b\W*?j\W*?e\W*?c\W*?t|\W*?e\W*?m\W*?b\W*?e\W*?d|\W*?a\W*?p\W*?p\W*?l\W*?e\W*?t|\W*?p\W*?a\W*?r\W*?a\W*?m|\W*?i?\W*?f\W*?r\W*?a\W*?m\W*?e|\W*?b\W*?a\W*?s\W*?e|\W*?b\W*?o\W*?d\W*?y|\W*?m\W*?e\W*?t\W*?a|\W*?i\W*?m\W*?a?\W*?g\W*?e?|\W*?v\W*?i\W*?d\W*?e\W*?o|\W*?a\W*?u\W*?d\W*?i\W*?o|\W*?b\W*?i\W*?n\W*?d\W*?i\W*?n\W*?g\W*?s|\W*?s\W*?e\W*?t|\W*?a\W*?n\W*?i\W*?m\W*?a\W*?t\W*?e)[^>\w])|(?:<\w[\s\S]*[\s\/]|['\"](?:[\s\S]*[\s\/])?)(?:formaction|style|background|src|lowsrc|ping|on(?:d(?:e(?:vice(?:(?:orienta|mo)tion|proximity|found|light)|livery(?:success|error)|activate)|r(?:ag(?:e(?:n(?:ter|d)|xit)|(?:gestur|leav)e|start|drop|over)?|op)|i(?:s(?:c(?:hargingtimechange|onnect(?:ing|ed))|abled)|aling)|ata(?:setc(?:omplete|hanged)|(?:availabl|chang)e|error)|urationchange|ownloading|blclick)|Moz(?:M(?:agnifyGesture(?:Update|Start)?|ouse(?:PixelScroll|Hittest))|S(?:wipeGesture(?:Update|Start|End)?|crolledAreaChanged)|(?:(?:Press)?TapGestur|BeforeResiz)e|EdgeUI(?:C(?:omplet|ancel)|Start)ed|RotateGesture(?:Update|Start)?|A(?:udioAvailable|fterPaint))|c(?:o(?:m(?:p(?:osition(?:update|start|end)|lete)|mand(?:update)?)|n(?:t(?:rolselect|extmenu)|nect(?:ing|ed))|py)|a(?:(?:llschang|ch)ed|nplay(?:through)?|rdstatechange)|h(?:(?:arging(?:time)?ch)?ange|ecking)|(?:fstate|ell)change|u(?:echange|t)|l(?:ick|ose))|m(?:o(?:z(?:pointerlock(?:change|error)|(?:orientation|time)change|fullscreen(?:change|error)|network(?:down|up)load)|use(?:(?:lea|mo)ve|o(?:ver|ut)|enter|wheel|down|up)|ve(?:start|end)?)|essage|ark)|s(?:t(?:a(?:t(?:uschanged|echange)|lled|rt)|k(?:sessione|comma)nd|op)|e(?:ek(?:complete|ing|ed)|(?:lec(?:tstar)?)?t|n(?:ding|t))|u(?:ccess|spend|bmit)|peech(?:start|end)|ound(?:start|end)|croll|how)|b(?:e(?:for(?:e(?:(?:scriptexecu|activa)te|u(?:nload|pdate)|p(?:aste|rint)|c(?:opy|ut)|editfocus)|deactivate)|gin(?:Event)?)|oun(?:dary|ce)|l(?:ocked|ur)|roadcast|usy)|a(?:n(?:imation(?:iteration|start|end)|tennastatechange)|fter(?:(?:scriptexecu|upda)te|print)|udio(?:process|start|end)|d(?:apteradded|dtrack)|ctivate|lerting|bort)|DOM(?:Node(?:Inserted(?:IntoDocument)?|Removed(?:FromDocument)?)|(?:CharacterData|Subtree)Modified|A(?:ttrModified|ctivate)|Focus(?:Out|In)|MouseScroll)|r(?:e(?:s(?:u(?:m(?:ing|e)|lt)|ize|et)|adystatechange|pea(?:tEven)?t|movetrack|trieving|ceived)|ow(?:s(?:inserted|delete)|e(?:nter|xit))|atechange)|p(?:op(?:up(?:hid(?:den|ing)|show(?:ing|n))|state)|a(?:ge(?:hide|show)|(?:st|us)e|int)|ro(?:pertychange|gress)|lay(?:ing)?)|t(?:ouch(?:(?:lea|mo)ve|en(?:ter|d)|cancel|start)|ime(?:update|out)|ransitionend|ext)|u(?:s(?:erproximity|sdreceived)|p(?:gradeneeded|dateready)|n(?:derflow|load))|f(?:o(?:rm(?:change|input)|cus(?:out|in)?)|i(?:lterchange|nish)|ailed)|l(?:o(?:ad(?:e(?:d(?:meta)?data|nd)|start)?|secapture)|evelchange|y)|g(?:amepad(?:(?:dis)?connected|button(?:down|up)|axismove)|et)|e(?:n(?:d(?:Event|ed)?|abled|ter)|rror(?:update)?|mptied|xit)|i(?:cc(?:cardlockerror|infochange)|n(?:coming|valid|put))|o(?:(?:(?:ff|n)lin|bsolet)e|verflow(?:changed)?|pen)|SVG(?:(?:Unl|L)oad|Resize|Scroll|Abort|Error|Zoom)|h(?:e(?:adphoneschange|l[dp])|ashchange|olding)|v(?:o(?:lum|ic)e|ersion)change|w(?:a(?:it|rn)ing|heel)|key(?:press|down|up)|(?:AppComman|Loa)d|no(?:update|match)|Request|zoom))[\s\x08]*?=" \ +# Regexp generated from util/regexp-assemble/regexp-941160.data using Regexp::Assemble. +# To rebuild the regexp: +# cd util/regexp-assemble +# ./regexp-assemble.pl regexp-941160.data +# Note that after assemble an ignore case flag (i) is added to the to the Regexp::Assemble output: +# Add ignore case flag between '?' and ':': "(?i:...)" +# +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|REQUEST_HEADERS:Referer|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:<\w[\s\S]*[\s\/]|['\"](?:[\s\S]*[\s\/])?)(?:on(?:d(?:e(?:vice(?:(?:orienta|mo)tion|proximity|found|light)|livery(?:success|error)|activate)|r(?:ag(?:e(?:n(?:ter|d)|xit)|(?:gestur|leav)e|start|drop|over)|op)|i(?:s(?:c(?:hargingtimechange|onnect(?:ing|ed))|abled)|aling)|ata(?:setc(?:omplete|hanged)|(?:availabl|chang)e|error)|urationchange|ownloading|blclick)|Moz(?:M(?:agnifyGesture(?:Update|Start)?|ouse(?:PixelScroll|Hittest))|S(?:wipeGesture(?:Update|Start|End)?|crolledAreaChanged)|(?:(?:Press)?TapGestur|BeforeResiz)e|EdgeUI(?:C(?:omplet|ancel)|Start)ed|RotateGesture(?:Update|Start)?|A(?:udioAvailable|fterPaint))|c(?:o(?:m(?:p(?:osition(?:update|start|end)|lete)|mand(?:update)?)|n(?:t(?:rolselect|extmenu)|nect(?:ing|ed))|py)|a(?:(?:llschang|ch)ed|nplay(?:through)?|rdstatechange)|h(?:(?:arging(?:time)?ch)?ange|ecking)|(?:fstate|ell)change|u(?:echange|t)|l(?:ick|ose))|s(?:t(?:a(?:t(?:uschanged|echange)|lled|rt)|k(?:sessione|comma)nd|op)|e(?:ek(?:complete|ing|ed)|(?:lec(?:tstar)?)?t|n(?:ding|t))|(?:peech|ound)(?:start|end)|u(?:ccess|spend|bmit)|croll|how)|m(?:o(?:z(?:(?:pointerlock|fullscreen)(?:change|error)|(?:orientation|time)change|network(?:down|up)load)|use(?:(?:lea|mo)ve|o(?:ver|ut)|enter|wheel|down|up)|ve(?:start|end)?)|essage|ark)|b(?:e(?:for(?:e(?:(?:scriptexecu|activa)te|u(?:nload|pdate)|p(?:aste|rint)|c(?:opy|ut)|editfocus)|deactivate)|gin(?:Event)?)|oun(?:dary|ce)|l(?:ocked|ur)|roadcast|usy)|a(?:n(?:imation(?:iteration|start|end)|tennastatechange)|fter(?:(?:scriptexecu|upda)te|print)|udio(?:process|start|end)|d(?:apteradded|dtrack)|ctivate|lerting|bort)|DOM(?:Node(?:Inserted(?:IntoDocument)?|Removed(?:FromDocument)?)|(?:CharacterData|Subtree)Modified|A(?:ttrModified|ctivate)|Focus(?:Out|In)|MouseScroll)|r(?:e(?:s(?:u(?:m(?:ing|e)|lt)|ize|et)|adystatechange|pea(?:tEven)?t|movetrack|trieving|ceived)|ow(?:s(?:inserted|delete)|e(?:nter|xit))|atechange)|p(?:op(?:up(?:hid(?:den|ing)|show(?:ing|n))|state)|a(?:ge(?:hide|show)|(?:st|us)e|int)|ro(?:pertychange|gress)|lay(?:ing)?)|t(?:ouch(?:(?:lea|mo)ve|en(?:ter|d)|cancel|start)|ime(?:update|out)|ransitionend|ext)|u(?:s(?:erproximity|sdreceived)|p(?:gradeneeded|dateready)|n(?:derflow|load))|f(?:o(?:rm(?:change|input)|cus(?:out|in)?)|i(?:lterchange|nish)|ailed)|l(?:o(?:ad(?:e(?:d(?:meta)?data|nd)|start)|secapture)|evelchange|y)|g(?:amepad(?:(?:dis)?connected|button(?:down|up)|axismove)|et)|e(?:n(?:d(?:Event|ed)?|abled|ter)|rror(?:update)?|mptied|xit)|i(?:cc(?:cardlockerror|infochange)|n(?:coming|valid|put))|o(?:(?:(?:ff|n)lin|bsolet)e|verflow(?:changed)?|pen)|SVG(?:(?:Unl|L)oad|Resize|Scroll|Abort|Error|Zoom)|h(?:e(?:adphoneschange|l[dp])|ashchange|olding)|v(?:o(?:lum|ic)e|ersion)change|w(?:a(?:it|rn)ing|heel)|key(?:press|down|up)|(?:AppComman|Loa)d|no(?:update|match)|Request|zoom)|s(?:tyle|rc)|background|formaction|lowsrc|ping)[\s\x08]*?=|<[^\w<>]*(?:[^<>\"'\s]*:)?[^\w<>]*\W*?(?:(?:a\W*?(?:n\W*?i\W*?m\W*?a\W*?t\W*?e|p\W*?p\W*?l\W*?e\W*?t|u\W*?d\W*?i\W*?o)|b\W*?(?:i\W*?n\W*?d\W*?i\W*?n\W*?g\W*?s|a\W*?s\W*?e|o\W*?d\W*?y)|i?\W*?f\W*?r\W*?a\W*?m\W*?e|o\W*?b\W*?j\W*?e\W*?c\W*?t|i\W*?m\W*?a?\W*?g\W*?e?|e\W*?m\W*?b\W*?e\W*?d|p\W*?a\W*?r\W*?a\W*?m|v\W*?i\W*?d\W*?e\W*?o|l\W*?i\W*?n\W*?k)[^>\w]|s\W*?(?:c\W*?r\W*?i\W*?p\W*?t|t\W*?y\W*?l\W*?e|e\W*?t[^>\w]|v\W*?g)|m\W*?(?:a\W*?r\W*?q\W*?u\W*?e\W*?e|e\W*?t\W*?a[^>\w])|f\W*?o\W*?r\W*?m))" \ "id:941160,\ phase:2,\ block,\ @@ -202,6 +204,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_H tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-xss',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/XSS',\ tag:'WASCTC/WASC-8',\ tag:'WASCTC/WASC-22',\ @@ -209,12 +212,10 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_H tag:'OWASP_AppSensor/IE1',\ tag:'CAPEC-242',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/XSS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # @@ -232,6 +233,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_H tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-xss',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/XSS',\ tag:'WASCTC/WASC-8',\ tag:'WASCTC/WASC-22',\ @@ -239,19 +241,17 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_H tag:'OWASP_AppSensor/IE1',\ tag:'CAPEC-242',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/XSS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # # [Blacklist Keywords from Node-Validator] # https://raw.github.com/chriso/node-validator/master/validator.js # -SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@pm document.cookie document.write document[ self[ .parentnode .innerhtml window.location -moz-binding .*?((@[i\\\\])|(([:=]|(&#x?0*((58)|(3A)|(61)|(3D));?)).*?([(\\\\]|(&#x?0*((40)|(28)|(92)|(5C));?)))))" \ +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:.*?(?:@[i\\\\]|(?:[:=]|&#x?0*(?:58|3A|61|3D);?).*?(?:[(\\\\]|&#x?0*(?:40|28|92|5C);?)))" \ "id:941190,\ phase:2,\ block,\ @@ -295,6 +294,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-xss',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/XSS',\ tag:'WASCTC/WASC-8',\ tag:'WASCTC/WASC-22',\ @@ -302,12 +302,10 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'OWASP_AppSensor/IE1',\ tag:'CAPEC-242',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/XSS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:<.*[:]?vmlframe.*?[\s/+]*?src[\s/+]*=)" \ @@ -322,6 +320,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-xss',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/XSS',\ tag:'WASCTC/WASC-8',\ tag:'WASCTC/WASC-22',\ @@ -329,15 +328,13 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'OWASP_AppSensor/IE1',\ tag:'CAPEC-242',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/XSS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" -SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(j|(&#x?0*((74)|(4A)|(106)|(6A));?))([\t]|(&((#x?0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*(a|(&#x?0*((65)|(41)|(97)|(61));?))([\t]|(&((#x?0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*(v|(&#x?0*((86)|(56)|(118)|(76));?))([\t]|(&((#x?0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*(a|(&#x?0*((65)|(41)|(97)|(61));?))([\t]|(&((#x?0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*(s|(&#x?0*((83)|(53)|(115)|(73));?))([\t]|(&((#x?0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*(c|(&#x?0*((67)|(43)|(99)|(63));?))([\t]|(&((#x?0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*(r|(&#x?0*((82)|(52)|(114)|(72));?))([\t]|(&((#x?0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*(i|(&#x?0*((73)|(49)|(105)|(69));?))([\t]|(&((#x?0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*(p|(&#x?0*((80)|(50)|(112)|(70));?))([\t]|(&((#x?0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*(t|(&#x?0*((84)|(54)|(116)|(74));?))([\t]|(&((#x?0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*(:|(&((#x?0*((58)|(3A));?)|(colon;)))).)" \ +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:j|&#x?0*(?:74|4A|106|6A);?)(?:\t|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:a|&#x?0*(?:65|41|97|61);?)(?:\t|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:v|&#x?0*(?:86|56|118|76);?)(?:\t|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:a|&#x?0*(?:65|41|97|61);?)(?:\t|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:s|&#x?0*(?:83|53|115|73);?)(?:\t|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:c|&#x?0*(?:67|43|99|63);?)(?:\t|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:r|&#x?0*(?:82|52|114|72);?)(?:\t|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:i|&#x?0*(?:73|49|105|69);?)(?:\t|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:p|&#x?0*(?:80|50|112|70);?)(?:\t|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:t|&#x?0*(?:84|54|116|74);?)(?:\t|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?::|&(?:#x?0*(?:58|3A);?|colon;)).)" \ "id:941210,\ phase:2,\ block,\ @@ -349,6 +346,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-xss',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/XSS',\ tag:'WASCTC/WASC-8',\ tag:'WASCTC/WASC-22',\ @@ -356,15 +354,13 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'OWASP_AppSensor/IE1',\ tag:'CAPEC-242',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/XSS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" -SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(v|(&#x?0*((86)|(56)|(118)|(76));?))([\t]|(&((#x?0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*(b|(&#x?0*((66)|(42)|(98)|(62));?))([\t]|(&((#x?0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*(s|(&#x?0*((83)|(53)|(115)|(73));?))([\t]|(&((#x?0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*(c|(&#x?0*((67)|(43)|(99)|(63));?))([\t]|(&((#x?0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*(r|(&#x?0*((82)|(52)|(114)|(72));?))([\t]|(&((#x?0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*(i|(&#x?0*((73)|(49)|(105)|(69));?))([\t]|(&((#x?0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*(p|(&#x?0*((80)|(50)|(112)|(70));?))([\t]|(&((#x?0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*(t|(&#x?0*((84)|(54)|(116)|(74));?))([\t]|(&((#x?0*(9|(13)|(10)|A|D);?)|(tab;)|(newline;))))*(:|(&((#x?0*((58)|(3A));?)|(colon;)))).)" \ +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:v|&#x?0*(?:86|56|118|76);?)(?:\t|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:b|&#x?0*(?:66|42|98|62);?)(?:\t|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:s|&#x?0*(?:83|53|115|73);?)(?:\t|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:c|&#x?0*(?:67|43|99|63);?)(?:\t|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:r|&#x?0*(?:82|52|114|72);?)(?:\t|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:i|&#x?0*(?:73|49|105|69);?)(?:\t|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:p|&#x?0*(?:80|50|112|70);?)(?:\t|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:t|&#x?0*(?:84|54|116|74);?)(?:\t|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?::|&(?:#x?0*(?:58|3A);?|colon;)).)" \ "id:941220,\ phase:2,\ block,\ @@ -376,6 +372,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-xss',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/XSS',\ tag:'WASCTC/WASC-8',\ tag:'WASCTC/WASC-22',\ @@ -383,12 +380,10 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'OWASP_AppSensor/IE1',\ tag:'CAPEC-242',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/XSS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i)]" \ @@ -565,6 +554,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-xss',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/XSS',\ tag:'WASCTC/WASC-8',\ tag:'WASCTC/WASC-22',\ @@ -572,12 +562,10 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'OWASP_AppSensor/IE1',\ tag:'CAPEC-242',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/XSS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i) # +# This rule is also triggered by the following exploit(s): +# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ] +# SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx <(?:a|abbr|acronym|address|applet|area|audioscope|b|base|basefront|bdo|bgsound|big|blackface|blink|blockquote|body|bq|br|button|caption|center|cite|code|col|colgroup|comment|dd|del|dfn|dir|div|dl|dt|em|embed|fieldset|fn|font|form|frame|frameset|h1|head|hr|html|i|iframe|ilayer|img|input|ins|isindex|kdb|keygen|label|layer|legend|li|limittext|link|listing|map|marquee|menu|meta|multicol|nobr|noembed|noframes|noscript|nosmartquotes|object|ol|optgroup|option|p|param|plaintext|pre|q|rt|ruby|s|samp|script|select|server|shadow|sidebar|small|spacer|span|strike|strong|style|sub|sup|table|tbody|td|textarea|tfoot|th|thead|title|tr|tt|u|ul|var|wbr|xml|xmp)\W" \ "id:941320,\ phase:2,\ @@ -809,6 +865,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQU tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-xss',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/XSS',\ tag:'WASCTC/WASC-8',\ tag:'WASCTC/WASC-22',\ @@ -816,25 +873,24 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQU tag:'OWASP_AppSensor/IE1',\ tag:'PCI/6.5.1',\ tag:'paranoia-level/2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/XSS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'" -SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:[\"\'][ ]*(([^a-z0-9~_:\' ])|(in)).*?(((l|(\\\\u006C))(o|(\\\\u006F))(c|(\\\\u0063))(a|(\\\\u0061))(t|(\\\\u0074))(i|(\\\\u0069))(o|(\\\\u006F))(n|(\\\\u006E)))|((n|(\\\\u006E))(a|(\\\\u0061))(m|(\\\\u006D))(e|(\\\\u0065)))|((o|(\\\\u006F))(n|(\\\\u006E))(e|(\\\\u0065))(r|(\\\\u0072))(r|(\\\\u0072))(o|(\\\\u006F))(r|(\\\\u0072)))|((v|(\\\\u0076))(a|(\\\\u0061))(l|(\\\\u006C))(u|(\\\\u0075))(e|(\\\\u0065))(O|(\\\\u004F))(f|(\\\\u0066)))).*?=)" \ +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:[\"'][ ]*(?:[^a-z0-9~_:' ]|in).*?(?:(?:l|\\\\u006C)(?:o|\\\\u006F)(?:c|\\\\u0063)(?:a|\\\\u0061)(?:t|\\\\u0074)(?:i|\\\\u0069)(?:o|\\\\u006F)(?:n|\\\\u006E)|(?:n|\\\\u006E)(?:a|\\\\u0061)(?:m|\\\\u006D)(?:e|\\\\u0065)|(?:o|\\\\u006F)(?:n|\\\\u006E)(?:e|\\\\u0065)(?:r|\\\\u0072)(?:r|\\\\u0072)(?:o|\\\\u006F)(?:r|\\\\u0072)|(?:v|\\\\u0076)(?:a|\\\\u0061)(?:l|\\\\u006C)(?:u|\\\\u0075)(?:e|\\\\u0065)(?:O|\\\\u004F)(?:f|\\\\u0066)).*?=)" \ "id:941330,\ phase:2,\ block,\ capture,\ - t:none,t:urlDecodeUni,t:htmlEntityDecode,t:compressWhiteSpace,\ + t:none,t:urlDecodeUni,t:htmlEntityDecode,t:compressWhitespace,\ msg:'IE XSS Filters - Attack Detected.',\ logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\ tag:'application-multi',\ tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-xss',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/XSS',\ tag:'WASCTC/WASC-8',\ tag:'WASCTC/WASC-22',\ @@ -842,25 +898,27 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQU tag:'OWASP_AppSensor/IE1',\ tag:'PCI/6.5.1',\ tag:'paranoia-level/2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/XSS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'" +# This rule is also triggered by the following exploit(s): +# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ] +# SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i)[\"\'][ ]*(?:[^a-z0-9~_:\' ]|in).+?[.].+?=" \ "id:941340,\ phase:2,\ block,\ capture,\ - t:none,t:urlDecodeUni,t:htmlEntityDecode,t:compressWhiteSpace,\ + t:none,t:urlDecodeUni,t:htmlEntityDecode,t:compressWhitespace,\ msg:'IE XSS Filters - Attack Detected.',\ logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\ tag:'application-multi',\ tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-xss',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/XSS',\ tag:'WASCTC/WASC-8',\ tag:'WASCTC/WASC-22',\ @@ -868,13 +926,45 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQU tag:'OWASP_AppSensor/IE1',\ tag:'PCI/6.5.1',\ tag:'paranoia-level/2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/XSS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'" +# +# Defend against AngularJS client side template injection +# +# Of course, pure client-side AngularJS commands can not be intercepted. +# But once a command is sent to the server, the CRS will trigger. +# +# https://portswigger.net/blog/xss-without-html-client-side-template-injection-with-angularjs +# +# Example payload: +# http://localhost/login?user=%20x%20%7B%7Bconstructor.constructor(%27alert(1)%27)()%7D%7D%20.%20ff +# Decoded argument: +# {{constructor.constructor('alert(1)')()}} +# +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx {{.*?}}" \ + "id:941380,\ + phase:2,\ + block,\ + capture,\ + t:none,\ + msg:'AngularJS client side template injection detected',\ + logdata:'Matched Data: Suspicious payload found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\ + tag:'application-multi',\ + tag:'language-multi',\ + tag:'attack-xss',\ + tag:'OWASP_CRS',\ + tag:'OWASP_CRS/WEB_ATTACK/XSS',\ + tag:'OWASP_TOP_10/A7',\ + tag:'CAPEC-63',\ + tag:'paranoia-level/2',\ + ctl:auditLogParts=+E,\ + ver:'OWASP_CRS/3.2.0',\ + severity:'CRITICAL',\ + setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\ + setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'" diff --git a/confs/owasp-crs/REQUEST-942-APPLICATION-ATTACK-SQLI.conf b/confs/owasp-crs/REQUEST-942-APPLICATION-ATTACK-SQLI.conf index 3a84d85..6a480b0 100644 --- a/confs/owasp-crs/REQUEST-942-APPLICATION-ATTACK-SQLI.conf +++ b/confs/owasp-crs/REQUEST-942-APPLICATION-ATTACK-SQLI.conf @@ -1,5 +1,5 @@ # ------------------------------------------------------------------------ -# OWASP ModSecurity Core Rule Set ver.3.1.1 +# OWASP ModSecurity Core Rule Set ver.3.2.0 # Copyright (c) 2006-2019 Trustwave and contributors. All rights reserved. # # The OWASP ModSecurity Core Rule Set is distributed under @@ -38,6 +38,8 @@ SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 1" "id:942012,phase:2,pass,nolog,skipAf # # -=[ LibInjection Check ]=- # +# There is a stricter sibling of this rule at 941101. It covers REQUEST_BASENAME. +# # Ref: https://libinjection.client9.com/ # SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|REQUEST_HEADERS:Referer|ARGS_NAMES|ARGS|XML:/* "@detectSQLi" \ @@ -52,18 +54,17 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_H tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ multiMatch,\ setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.msg=%{rule.msg}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQL_INJECTION-%{MATCHED_VAR_NAME}=%{MATCHED_VAR}'" + setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'" # @@ -89,18 +90,17 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQL_INJECTION-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # @@ -120,13 +120,12 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQLI-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # Regexp generated from util/regexp-assemble/regexp-942170.data using Regexp::Assemble. # To rebuild the regexp: @@ -148,17 +147,16 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQLI-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # Regexp generated from util/regexp-assemble/regexp-942190.data using Regexp::Assemble. # To rebuild the regexp: @@ -180,17 +178,16 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQLI-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx ^(?i:-0000023456|4294967295|4294967296|2147483648|2147483647|0000012345|-2147483648|-2147483649|0000023456|3.0.00738585072007e-308|1e309)$" \ "id:942220,\ @@ -204,19 +201,18 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQLI-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" -SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:[\s()]case\s*?\()|(?:\)\s*?like\s*?\()|(?:having\s*?[^\s]+\s*?[^\w\s])|(?:if\s?\([\d\w]\s*?[=<>~]))" \ +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:[\s()]case\s*?\(|\)\s*?like\s*?\(|having\s*?[^\s]+\s*?[^\w\s]|if\s?\([\d\w]\s*?[=<>~])" \ "id:942230,\ phase:2,\ block,\ @@ -228,17 +224,16 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQLI-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # Regexp generated from util/regexp-assemble/regexp-942240.data using Regexp::Assemble. # To rebuild the regexp: @@ -260,19 +255,18 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQLI-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" -SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:merge.*?using\s*?\()|(execute\s*?immediate\s*?[\"'`])|(?:match\s*?[\w(),+-]+\s*?against\s*?\())" \ +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:merge.*?using\s*?\(|execute\s*?immediate\s*?[\"'`]|match\s*?[\w(),+-]+\s*?against\s*?\()" \ "id:942250,\ phase:2,\ block,\ @@ -284,19 +278,18 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQLI-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" -SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:(union(.*?)select(.*?)from)))" \ +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i)union.*?select.*?from" \ "id:942270,\ phase:2,\ block,\ @@ -308,17 +301,16 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQLI-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # Regexp generated from util/regexp-assemble/regexp-942280.data using Regexp::Assemble. # To rebuild the regexp: @@ -340,17 +332,16 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQLI-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:\[\$(?:ne|eq|lte?|gte?|n?in|mod|all|size|exists|type|slice|x?or|div|like|between|and)\]))" \ "id:942290,\ @@ -364,17 +355,16 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQLI-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # Regexp generated from util/regexp-assemble/regexp-942320.data using Regexp::Assemble. # To rebuild the regexp: @@ -396,17 +386,16 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQLI-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # Regexp generated from util/regexp-assemble/regexp-942350.data using Regexp::Assemble. # To rebuild the regexp: @@ -428,17 +417,16 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQLI-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # This rule has a stricter sibling: 942361. # The keywords 'alter' and 'union' led to false positives. @@ -471,18 +459,54 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQLI-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" +# +# -=[ Detect MySQL in-line comments ]=- +# +# MySQL in-line comments can be used to bypass SQLi detection. +# +# Ref: https://dev.mysql.com/doc/refman/8.0/en/comments.html: +# SELECT /*! STRAIGHT_JOIN */ col1 FROM table1,table2 WHERE ... +# CREATE TABLE t1(a INT, KEY (a)) /*!50110 KEY_BLOCK_SIZE=1024 */; +# SELECT /*+ BKA(t1) */ FROM ... ; +# +# http://localhost/test.php?id=9999+or+{if+length((/*!5000select+username/*!50000from*/user+where+id=1))>0} +# +# The minimal string that triggers this regexp is: /*!*/ or /*+*/. +# The rule 942500 is related to 942440 which catches both /*! and */ independently. +# +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:/\*[!+](?:[\w\s=_\-()]+)?\*/)" \ + "id:942500,\ + phase:2,\ + block,\ + capture,\ + t:none,t:urlDecodeUni,\ + msg:'MySQL in-line comment detected.',\ + logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\ + tag:'application-multi',\ + tag:'language-multi',\ + tag:'platform-multi',\ + tag:'attack-sqli',\ + tag:'OWASP_CRS',\ + tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ + tag:'WASCTC/WASC-19',\ + tag:'OWASP_TOP_10/A1',\ + tag:'OWASP_AppSensor/CIE1',\ + tag:'PCI/6.5.2',\ + ver:'OWASP_CRS/3.2.0',\ + severity:'CRITICAL',\ + setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 2" "id:942013,phase:1,pass,nolog,skipAfter:END-REQUEST-942-APPLICATION-ATTACK-SQLI" @@ -498,7 +522,10 @@ SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 2" "id:942014,phase:2,pass,nolog,skipAf # Identifies common initial SQLi probing requests where attackers insert/append # quote characters to the existing normal payload to see how the app/db responds. # -SecRule ARGS_NAMES|ARGS|XML:/* "@rx (^\s*[\"'`;]+|[\"'`]+\s*$)" \ +# This rule is also triggered by the following exploit(s): +# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ] +# +SecRule ARGS_NAMES|ARGS|XML:/* "@rx (?:^\s*[\"'`;]+|[\"'`]+\s*$)" \ "id:942110,\ phase:2,\ block,\ @@ -510,23 +537,25 @@ SecRule ARGS_NAMES|ARGS|XML:/* "@rx (^\s*[\"'`;]+|[\"'`]+\s*$)" \ tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ tag:'paranoia-level/2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'WARNING',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.warning_anomaly_score}',\ - setvar:'tx.anomaly_score_pl2=+%{tx.warning_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQL_INJECTION-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl2=+%{tx.warning_anomaly_score}'" # # -=[ SQL Operators ]=- # +# This rule is also triggered by the following exploit(s): +# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ] +# # Regexp generated from util/regexp-assemble/regexp-942120.data using Regexp::Assemble. # To rebuild the regexp: # cd util/regexp-assemble @@ -547,18 +576,17 @@ SecRule ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:(?:^|\W)in[+\s]*\([\s\d\"]+[^()]*\)|\ tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ tag:'paranoia-level/2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQL_INJECTION-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'" # @@ -572,7 +600,9 @@ SecRule ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:(?:^|\W)in[+\s]*\([\s\d\"]+[^()]*\)|\ # to the Regexp::Assemble output: # (?i:ASSEMBLE_OUTPUT) # -SecRule ARGS_NAMES|ARGS|XML:/* "@rx (?i:([\s'\"`\(\)]*?)([\d\w]++)([\s'\"`\(\)]*?)(?:<(?:=(?:([\s'\"`\(\)]*?)(?!\2)([\d\w]+)|>([\s'\"`\(\)]*?)(?:\2))|>?([\s'\"`\(\)]*?)(?!\2)([\d\w]+))|(?:not\s+(?:regexp|like)|is\s+not|>=?|!=|\^)([\s'\"`\(\)]*?)(?!\2)([\d\w]+)|(?:(?:sounds\s+)?like|r(?:egexp|like)|=)([\s'\"`\(\)]*?)(?:\2)))" \ +# Not supported by re2 (++, ?!re). +# +SecRule ARGS_NAMES|ARGS|XML:/* "@rx (?i:[\s'\"`()]*?([\d\w]++)[\s'\"`()]*?(?:<(?:=(?:[\s'\"`()]*?(?!\1)[\d\w]+|>[\s'\"`()]*?(?:\1))|>?[\s'\"`()]*?(?!\1)[\d\w]+)|(?:not\s+(?:regexp|like)|is\s+not|>=?|!=|\^)[\s'\"`()]*?(?!\1)[\d\w]+|(?:(?:sounds\s+)?like|r(?:egexp|like)|=)[\s'\"`()]*?(?:\1)))" \ "id:942130,\ phase:2,\ block,\ @@ -584,34 +614,36 @@ SecRule ARGS_NAMES|ARGS|XML:/* "@rx (?i:([\s'\"`\(\)]*?)([\d\w]++)([\s'\"`\(\)]* tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ tag:'paranoia-level/2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ multiMatch,\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQL_INJECTION-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'" # # -=[ SQL Function Names ]=- # -# Regexp generated from rules/sql-function-names.data using Regexp::Assemble. +# This rule is also triggered by the following exploit(s): +# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ] +# +# Regexp generated from util/regexp-assemble/regexp-942150.data using Regexp::Assemble. # To rebuild the regexp: # cd util/regexp-assemble -# ./regexp-assemble.pl ../../rules/sql-function-names.data +# ./regexp-assemble.pl regexp-942150.data # Note that after assemble an ignore case flag and a word boundary is added # in front of the Regexp::Assemble output. # And a non-word character and an opening bracket is added behind the Regexp::Assemble output: # (?i)\bASSEMBLE_OUTPUT\W*\( # -SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@pmf sql-function-names.data" \ +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i)\b(?:c(?:o(?:n(?:v(?:ert(?:_tz)?)?|cat(?:_ws)?|nection_id)|(?:mpres)?s|ercibility|(?:un)?t|llation|alesce)|ur(?:rent_(?:time(?:stamp)?|date|user)|(?:dat|tim)e)|h(?:ar(?:(?:acter)?_length|set)?|r)|iel(?:ing)?|ast|r32)|s(?:u(?:b(?:str(?:ing(?:_index)?)?|(?:dat|tim)e)|m)|t(?:d(?:dev_(?:sam|po)p)?|r(?:_to_date|cmp))|e(?:c(?:_to_time|ond)|ssion_user)|ys(?:tem_user|date)|ha[12]?|oundex|chema|ig?n|leep|pace|qrt)|i(?:s(?:_(?:ipv(?:4(?:_(?:compat|mapped))?|6)|n(?:ot(?:_null)?|ull)|(?:free|used)_lock)|null)|n(?:et(?:6_(?:aton|ntoa)|_(?:aton|ntoa))|s(?:ert|tr)|terval)?|f(?:null)?)|d(?:a(?:t(?:e(?:_(?:format|add|sub)|diff)?|abase)|y(?:of(?:month|week|year)|name)?)|e(?:(?:s_(?:de|en)cryp|faul)t|grees|code)|count|ump)|l(?:o(?:ca(?:l(?:timestamp)?|te)|g(?:10|2)?|ad_file|wer)|ast(?:_(?:inser_id|day))?|e(?:(?:as|f)t|ngth)|case|trim|pad|n)|u(?:n(?:compress(?:ed_length)?|ix_timestamp|hex)|tc_(?:time(?:stamp)?|date)|p(?:datexml|per)|uid(?:_short)?|case|ser)|t(?:ime(?:_(?:format|to_sec)|stamp(?:diff|add)?|diff)?|o(?:(?:second|day)s|_base64|n?char)|r(?:uncate|im)|an)|m(?:a(?:ke(?:_set|date)|ster_pos_wait|x)|i(?:(?:crosecon)?d|n(?:ute)?)|o(?:nth(?:name)?|d)|d5)|r(?:e(?:p(?:lace|eat)|lease_lock|verse)|a(?:wtohex|dians|nd)|o(?:w_count|und)|ight|trim|pad)|f(?:i(?:eld(?:_in_set)?|nd_in_set)|rom_(?:unixtime|base64|days)|o(?:und_rows|rmat)|loor)|p(?:o(?:w(?:er)?|sition)|eriod_(?:diff|add)|rocedure_analyse|assword|g_sleep|i)|a(?:s(?:cii(?:str)?|in)|es_(?:de|en)crypt|dd(?:dat|tim)e|(?:co|b)s|tan2?|vg)|b(?:i(?:t_(?:length|count|x?or|and)|n(?:_to_num)?)|enchmark)|e(?:x(?:tract(?:value)?|p(?:ort_set)?)|nc(?:rypt|ode)|lt)|g(?:r(?:oup_conca|eates)t|et_(?:format|lock))|v(?:a(?:r(?:_(?:sam|po)p|iance)|lues)|ersion)|o(?:(?:ld_passwo)?rd|ct(?:et_length)?)|we(?:ek(?:ofyear|day)?|ight_string)|n(?:o(?:t_in|w)|ame_const|ullif)|h(?:ex(?:toraw)?|our)|qu(?:arter|ote)|year(?:week)?|xmltype)\W*\(" \ "id:942150,\ phase:2,\ block,\ @@ -623,6 +655,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ @@ -630,24 +663,20 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'PCI/6.5.2',\ tag:'paranoia-level/2',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - chain" - SecRule MATCHED_VARS "@rx (?i)\b(?:c(?:o(?:n(?:v(?:ert(?:_tz)?)?|cat(?:_ws)?|nection_id)|(?:mpres)?s|ercibility|(?:un)?t|llation|alesce)|ur(?:rent_(?:time(?:stamp)?|date|user)|(?:dat|tim)e)|h(?:ar(?:(?:acter)?_length|set)?|r)|iel(?:ing)?|ast|r32)|s(?:u(?:b(?:str(?:ing(?:_index)?)?|(?:dat|tim)e)|m)|t(?:d(?:dev_(?:sam|po)p)?|r(?:_to_date|cmp))|e(?:c(?:_to_time|ond)|ssion_user)|ys(?:tem_user|date)|ha[12]?|oundex|chema|ig?n|leep|pace|qrt)|i(?:s(?:_(?:ipv(?:4(?:_(?:compat|mapped))?|6)|n(?:ot(?:_null)?|ull)|(?:free|used)_lock)|null)|n(?:et(?:6_(?:aton|ntoa)|_(?:aton|ntoa))|s(?:ert|tr)|terval)?|f(?:null)?)|d(?:a(?:t(?:e(?:_(?:format|add|sub)|diff)?|abase)|y(?:of(?:month|week|year)|name)?)|e(?:(?:s_(?:de|en)cryp|faul)t|grees|code)|count|ump)|l(?:o(?:ca(?:l(?:timestamp)?|te)|g(?:10|2)?|ad_file|wer)|ast(?:_(?:inser_id|day))?|e(?:(?:as|f)t|ngth)|case|trim|pad|n)|u(?:n(?:compress(?:ed_length)?|ix_timestamp|hex)|tc_(?:time(?:stamp)?|date)|p(?:datexml|per)|uid(?:_short)?|case|ser)|t(?:ime(?:_(?:format|to_sec)|stamp(?:diff|add)?|diff)?|o(?:(?:second|day)s|_base64|n?char)|r(?:uncate|im)|an)|m(?:a(?:ke(?:_set|date)|ster_pos_wait|x)|i(?:(?:crosecon)?d|n(?:ute)?)|o(?:nth(?:name)?|d)|d5)|r(?:e(?:p(?:lace|eat)|lease_lock|verse)|a(?:wtohex|dians|nd)|o(?:w_count|und)|ight|trim|pad)|f(?:i(?:eld(?:_in_set)?|nd_in_set)|rom_(?:unixtime|base64|days)|o(?:und_rows|rmat)|loor)|p(?:o(?:w(?:er)?|sition)|eriod_(?:diff|add)|rocedure_analyse|assword|g_sleep|i)|a(?:s(?:cii(?:str)?|in)|es_(?:de|en)crypt|dd(?:dat|tim)e|(?:co|b)s|tan2?|vg)|b(?:i(?:t_(?:length|count|x?or|and)|n(?:_to_num)?)|enchmark)|e(?:x(?:tract(?:value)?|p(?:ort_set)?)|nc(?:rypt|ode)|lt)|g(?:r(?:oup_conca|eates)t|et_(?:format|lock))|v(?:a(?:r(?:_(?:sam|po)p|iance)|lues)|ersion)|o(?:(?:ld_passwo)?rd|ct(?:et_length)?)|we(?:ek(?:ofyear|day)?|ight_string)|n(?:o(?:t_in|w)|ame_const|ullif)|h(?:ex(?:toraw)?|our)|qu(?:arter|ote)|year(?:week)?|xmltype)\W*\(" \ - "setvar:'tx.msg=%{rule.msg}',\ - setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQL_INJECTION-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ + setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'" # Regexp generated from util/regexp-assemble/regexp-942180.data using Regexp::Assemble. # To rebuild the regexp: # cd util/regexp-assemble # ./regexp-assemble.pl regexp-942180.data -# Note that after assemble an outer bracket with an ignore case flag is added -# to the Regexp::Assemble output: -# (?i:ASSEMBLE_OUTPUT) +# Note that after assemble an ignore case flag is inserted in the +# first non-capturing group from the Regexp::Assemble output: +# ASSEMBLE_OUTPUT | s/^(?:/(?i:/ # -SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:[\"'`](?:\s*?(?:(?:between|x?or|and|div)[\w\s-]+\s*?[+<>=(),-]\s*?[\d\"'`]|like(?:[\w\s-]+\s*?[+<>=(),-]\s*?[\d\"'`]|\W+[\w\"'`(])|[!=|](?:[\d\s!=+-]+.*?[\"'`(].*?|[\d\s!=]+.*?\d+)$|[^\w\s]?=\s*?[\"'`])|(?:\W*?[+=]+\W*?|[<>~]+)[\"'`])|(\/\*)+[\"'`]+\s?(?:\/\*|--|\{|#)?|\d[\"'`]\s+[\"'`]\s+\d|where\s[\s\w\.,-]+\s=|^admin\s*?[\"'`]|\sis\s*?0\W))" \ +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:[\"'`](?:\s*?(?:(?:between|x?or|and|div)[\w\s-]+\s*?[+<>=(),-]\s*?[\d\"'`]|like(?:[\w\s-]+\s*?[+<>=(),-]\s*?[\d\"'`]|\W+[\w\"'`(])|[!=|](?:[\d\s!=+-]+.*?[\"'`(].*?|[\d\s!=]+.*?\d+)$|[^\w\s]?=\s*?[\"'`])|(?:\W*?[+=]+\W*?|[<>~]+)[\"'`])|(?:/\*)+[\"'`]+\s?(?:\/\*|--|\{|#)?|\d[\"'`]\s+[\"'`]\s+\d|where\s[\s\w\.,-]+\s=|^admin\s*?[\"'`]|\sis\s*?0\W)" \ "id:942180,\ phase:2,\ block,\ @@ -659,19 +688,21 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ tag:'paranoia-level/2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQLI-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'" +# This rule is also triggered by the following exploit(s): +# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ] +# # Regexp generated from util/regexp-assemble/regexp-942200.data using Regexp::Assemble. # To rebuild the regexp: # cd util/regexp-assemble @@ -680,7 +711,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME # to the Regexp::Assemble output: # (?i:ASSEMBLE_OUTPUT) # -SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:(?:(?:(?:trunc|cre|upd)at|renam)e|(?:inser|selec)t|de(?:lete|sc)|alter|load)\s*?\(\s*?space\s*?\(|,.*?[)\da-f\"'`][\"'`](?:[\"'`].*?[\"'`]|[^\"'`]+|\Z)|\Wselect.+\W*?from))" \ +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:(?:(?:(?:trunc|cre|upd)at|renam)e|(?:inser|selec)t|de(?:lete|sc)|alter|load)\s*?\(\s*?space\s*?\(|,.*?[)\da-f\"'`][\"'`](?:[\"'`].*?[\"'`]|(?:\r?\n)?\z|[^\"'`]+)|\Wselect.+\W*?from))" \ "id:942200,\ phase:2,\ block,\ @@ -692,19 +723,21 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ tag:'paranoia-level/2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQLI-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'" +# This rule is also triggered by the following exploit(s): +# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ] +# # Regexp generated from util/regexp-assemble/regexp-942210.data using Regexp::Assemble. # To rebuild the regexp: # cd util/regexp-assemble @@ -725,18 +758,17 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ tag:'paranoia-level/2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQLI-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'" # Regexp generated from util/regexp-assemble/regexp-942260.data using Regexp::Assemble. # To rebuild the regexp: @@ -758,18 +790,17 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ tag:'paranoia-level/2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQLI-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'" # Regexp generated from util/regexp-assemble/regexp-942300.data using Regexp::Assemble. # To rebuild the regexp: @@ -791,18 +822,17 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ tag:'paranoia-level/2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQLI-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'" # Regexp generated from util/regexp-assemble/regexp-942310.data using Regexp::Assemble. # To rebuild the regexp: @@ -824,18 +854,17 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ tag:'paranoia-level/2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQLI-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'" # # -=[ SQL Injection Probings ]=- @@ -865,18 +894,17 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ tag:'paranoia-level/2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQLI-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'" # Regexp generated from util/regexp-assemble/regexp-942340.data using Regexp::Assemble. # To rebuild the regexp: @@ -900,31 +928,22 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ tag:'paranoia-level/2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQLI-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'" # This rule is a stricter sibling of 942360. # The keywords 'alter' and 'union' led to false positives. # Therefore they have been moved to PL2 and the keywords have been extended on PL1. # -# Regexp generated from util/regexp-assemble/regexp-942361.data using Regexp::Assemble. -# To rebuild the regexp: -# cd util/regexp-assemble -# ./regexp-assemble.pl regexp-942361.data -# Note that after assemble an outer bracket with an ignore case flag is added -# to the Regexp::Assemble output: -# (?i:ASSEMBLE_OUTPUT) -# SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:^[\W\d]+\s*?(?:alter|union)\b)" \ "id:942361,\ phase:2,\ @@ -937,29 +956,32 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ tag:'paranoia-level/2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQLI-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'" # This rule is a sibling of 942330. See that rule for a description and overview. +# +# This rule is also triggered by the following exploit(s): +# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ] +# # Regexp generated from util/regexp-assemble/regexp-942370.data using Regexp::Assemble. # To rebuild the regexp: # cd util/regexp-assemble # ./regexp-assemble.pl regexp-942370.data -# Note that after assemble an outer bracket with an ignore case flag is added +# Note that after assemble an ignore case flag is added # to the Regexp::Assemble output: # (?i:ASSEMBLE_OUTPUT) # -SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:[\"'`](?:\s*?(?:(?:\*.+(?:(?:an|i)d|between|like|x?or|div)\W*?[\"'`]|(?:between|like|x?or|and|div)\s[^\d]+[\w-]+.*?)\d|[^\w\s?]+\s*?[^\w\s]+\s*?[\"'`]|[^\w\s]+\s*?[\W\d].*?(?:--|#))|.*?\*\s*?\d)|^[\w\s\"'`-]+(?<=and\s)(?:(?<=between)|(?<=and\s)|(?<=like)|(?<=div)|(?<=xor)|(?<=or))(?<=xor\s)(?<=nand\s)(?<=not\s)(?<=\|\|)(?<=\&\&)\w+\(|[()\*<>%+-][\w-]+[^\w\s]+[\"'`][^,]|\^[\"'`]))" \ +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:[\"'`](?:\s*?(?:(?:\*.+(?:(?:an|i)d|between|like|x?or|div)\W*?[\"'`]|(?:between|like|x?or|and|div)\s[^\d]+[\w-]+.*?)\d|[^\w\s?]+\s*?[^\w\s]+\s*?[\"'`]|[^\w\s]+\s*?[\W\d].*?(?:--|#))|.*?\*\s*?\d)|[()\*<>%+-][\w-]+[^\w\s]+[\"'`][^,]|\^[\"'`])" \ "id:942370,\ phase:2,\ block,\ @@ -971,18 +993,17 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ tag:'paranoia-level/2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQLI-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'" # Regexp generated from util/regexp-assemble/regexp-942380.data using Regexp::Assemble. # To rebuild the regexp: @@ -1001,6 +1022,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQU tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ @@ -1008,12 +1030,10 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQU tag:'PCI/6.5.2',\ tag:'paranoia-level/2',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQL_INJECTION-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'" # Regexp generated from util/regexp-assemble/regexp-942390.data using Regexp::Assemble. # To rebuild the regexp: @@ -1032,6 +1052,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQU tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ @@ -1039,12 +1060,10 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQU tag:'PCI/6.5.2',\ tag:'paranoia-level/2',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQL_INJECTION-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'" # Regexp generated from util/regexp-assemble/regexp-942400.data using Regexp::Assemble. # To rebuild the regexp: @@ -1060,12 +1079,13 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQU block,\ capture,\ t:none,t:urlDecodeUni,\ - logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\ msg:'SQL Injection Attack',\ + logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\ tag:'application-multi',\ tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ @@ -1073,15 +1093,16 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQU tag:'PCI/6.5.2',\ tag:'paranoia-level/2',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQL_INJECTION-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'" # The former rule id 942410 was split into three new rules: 942410, 942470, 942480 # +# This rule is also triggered by the following exploit(s): +# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ] +# # Regexp generated from util/regexp-assemble/regexp-942410.data using Regexp::Assemble. # To rebuild the regexp: # cd util/regexp-assemble @@ -1104,6 +1125,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQU tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ @@ -1111,12 +1133,10 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQU tag:'PCI/6.5.2',\ tag:'paranoia-level/2',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQL_INJECTION-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'" # The former rule id 942410 was split into three new rules: 942410, 942470, 942480 @@ -1141,6 +1161,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQU tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ @@ -1148,12 +1169,10 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQU tag:'PCI/6.5.2',\ tag:'paranoia-level/2',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQL_INJECTION-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'" # The former rule id 942410 was split into three new rules: 942410, 942470, 942480 @@ -1178,6 +1197,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQU tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ @@ -1185,17 +1205,18 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQU tag:'PCI/6.5.2',\ tag:'paranoia-level/2',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQL_INJECTION-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'" # # [ SQL Injection Character Anomaly Usage ] # +# This rule is also triggered by the following exploit(s): +# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ] +# # This rules attempts to gauge when there is an excessive use of # meta-characters within a single parameter payload. # @@ -1221,18 +1242,17 @@ SecRule ARGS_NAMES|ARGS|XML:/* "@rx ((?:[~!@#\$%\^&\*\(\)\-\+=\{\}\[\]\|:;\"'´ tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ tag:'paranoia-level/2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'WARNING',\ setvar:'tx.anomaly_score_pl2=+%{tx.warning_anomaly_score}',\ - setvar:'tx.sql_injection_score=+%{tx.warning_anomaly_score}',\ - setvar:'tx.msg=%{rule.msg}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/RESTRICTED_SQLI_CHARS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.sql_injection_score=+%{tx.warning_anomaly_score}'" # @@ -1257,7 +1277,7 @@ SecRule ARGS_NAMES|ARGS|XML:/* "@rx ((?:[~!@#\$%\^&\*\(\)\-\+=\{\}\[\]\|:;\"'´ # 0/**/union/*!50000select*/table_name`foo`/**/ # ------------------------- # -SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (/\*!?|\*/|[';]--|--[\s\r\n\v\f]|(?:--[^-]*?-)|([^\-&])#.*?[\s\r\n\v\f]|;?\\x00)" \ +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?:/\*!?|\*/|[';]--|--[\s\r\n\v\f]|--[^-]*?-|[^&-]#.*?[\s\r\n\v\f]|;?\\x00)" \ "id:942440,\ phase:2,\ block,\ @@ -1269,24 +1289,23 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQU tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ tag:'paranoia-level/2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}',\ - setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.msg=%{rule.msg}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQL_INJECTION-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'" # # -=[ SQL Hex Evasion Methods ]=- # -SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:\A|[^\d])0x[a-f\d]{3,}[a-f\d]*)+" \ +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:\A|[^\d])0x[a-f\d]{3,})" \ "id:942450,\ phase:2,\ block,\ @@ -1298,20 +1317,70 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQU tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ tag:'paranoia-level/2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQL_INJECTION-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'" +# +# -=[ Detect SQLi bypass: backticks ]=- +# +# Quotes and backticks can be used to bypass SQLi detection. +# +# Example: +# GET http://localhost/test.php?id=9999%20or+{`if`(2=(select+2+from+wp_users+where+user_login='admin'))} +# +# The minimum text between the ticks or backticks must be 2 (if, for example) and a maximum of 29. +# 29 is a compromise: The lower this number (29), the lower the probability of FP and the higher the probability of false negatives. +# In tests we got a minimum number of FP with {2,29}. +# +# Base64 encoding detection: +# (?:[A-Za-z0-9+/]{4})+ #match any number of 4-letter blocks of the base64 char set +# (?:[A-Za-z0-9+/]{2}== #match 2-letter block of the base64 char set followed by "==", together forming a 4-letter block +# | # or +# [A-Za-z0-9+/]{3}= #match 3-letter block of the base64 char set followed by "=", together forming a 4-letter block +# )? +# +# The minimal string that triggers this regexp is: `if` +# +# The rule 942510 is related to 942110 which catches a single ' or ` +# +# The rule 942511 is similar to this rule, but triggers on normal quotes +# ('if'). That rule runs in paranoia level 3 or higher since it is prone to +# false positives in natural text. +# +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?:`((?:[\w\s=_\-+{}()<@]){2,29}|(?:[A-Za-z0-9+\/]{4})+(?:[A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=)?)`)" \ + "id:942510,\ + phase:2,\ + block,\ + capture,\ + t:none,t:urlDecodeUni,\ + msg:'SQLi bypass attempt by ticks or backticks detected.',\ + logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\ + tag:'application-multi',\ + tag:'language-multi',\ + tag:'platform-multi',\ + tag:'attack-sqli',\ + tag:'OWASP_CRS',\ + tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ + tag:'WASCTC/WASC-19',\ + tag:'OWASP_TOP_10/A1',\ + tag:'OWASP_AppSensor/CIE1',\ + tag:'PCI/6.5.2',\ + tag:'paranoia-level/2',\ + ver:'OWASP_CRS/3.2.0',\ + severity:'CRITICAL',\ + setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ + setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'" + SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 3" "id:942015,phase:1,pass,nolog,skipAfter:END-REQUEST-942-APPLICATION-ATTACK-SQLI" SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 3" "id:942016,phase:2,pass,nolog,skipAfter:END-REQUEST-942-APPLICATION-ATTACK-SQLI" @@ -1342,27 +1411,20 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ tag:'paranoia-level/3',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl3=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQLI-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl3=+%{tx.critical_anomaly_score}'" -# This rule is a stricter sibling of 942330. See that rule for a description and overview. -# Regexp generated from util/regexp-assemble/regexp-942490.data using Regexp::Assemble. -# To rebuild the regexp: -# cd util/regexp-assemble -# ./regexp-assemble.pl regexp-942490.data -# Note that after assemble an outer bracket is added -# to the Regexp::Assemble output: -# (?:ASSEMBLE_OUTPUT) +# This rule is a stricter sibling of 942330. See that rule for a +# description and overview. # SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx [\"'`][\s\d]*?[^\w\s]\W*?\d\W*?.*?[\"'`\d]" \ "id:942490,\ @@ -1376,18 +1438,17 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ tag:'paranoia-level/3',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl3=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQLI-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl3=+%{tx.critical_anomaly_score}'" # # [ SQL Injection Character Anomaly Usage ] @@ -1420,23 +1481,25 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQU tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ tag:'paranoia-level/3',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'WARNING',\ setvar:'tx.anomaly_score_pl3=+%{tx.warning_anomaly_score}',\ - setvar:'tx.sql_injection_score=+%{tx.warning_anomaly_score}',\ - setvar:'tx.msg=%{rule.msg}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/RESTRICTED_SQLI_CHARS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.sql_injection_score=+%{tx.warning_anomaly_score}'" # # This is a stricter sibling of rule 942430. # +# This rule is also triggered by the following exploit(s): +# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ] +# SecRule ARGS_NAMES|ARGS|XML:/* "@rx ((?:[~!@#\$%\^&\*\(\)\-\+=\{\}\[\]\|:;\"'´’‘`<>][^~!@#\$%\^&\*\(\)\-\+=\{\}\[\]\|:;\"'´’‘`<>]*?){6})" \ "id:942431,\ @@ -1450,18 +1513,17 @@ SecRule ARGS_NAMES|ARGS|XML:/* "@rx ((?:[~!@#\$%\^&\*\(\)\-\+=\{\}\[\]\|:;\"'´ tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ tag:'paranoia-level/3',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'WARNING',\ setvar:'tx.anomaly_score_pl3=+%{tx.warning_anomaly_score}',\ - setvar:'tx.sql_injection_score=+%{tx.warning_anomaly_score}',\ - setvar:'tx.msg=%{rule.msg}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/RESTRICTED_SQLI_CHARS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.sql_injection_score=+%{tx.warning_anomaly_score}'" # @@ -1484,19 +1546,108 @@ SecRule ARGS "@rx \W{4}" \ tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ tag:'paranoia-level/3',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'WARNING',\ - setvar:'tx.anomaly_score_pl3=+%{tx.warning_anomaly_score}',\ - setvar:'tx.msg=%{rule.msg}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.sql_injection_score=+%{tx.warning_anomaly_score}',\ + setvar:'tx.anomaly_score_pl3=+%{tx.warning_anomaly_score}'" +# +# This is a sibling of rule 942100 that adds checking of the last path segment. +# +# libinjection is more likely to fail when passing the full path. E.g. the following +# string produces a match: +# 999999.1 union select unhex(hex(version())) -- and 1=1 +# while this doesn't: +# /999999.1 union select unhex(hex(version())) -- and 1=1\. +# Therefore, we capture the last segment of the path and only match that with +# libinjection. Incidentally, the last path segment is also the most likely +# to be used for injection, other segments will most likely not be affected. +# +SecRule REQUEST_BASENAME "@detectSQLi" \ + "id:942101,\ + phase:2,\ + block,\ + capture,\ + t:none,t:utf8toUnicode,t:urlDecodeUni,t:removeNulls,\ + msg:'SQL Injection Attack Detected via libinjection',\ + logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\ + tag:'application-multi',\ + tag:'language-multi',\ + tag:'platform-multi',\ + tag:'attack-sqli',\ + tag:'OWASP_CRS',\ + tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ + tag:'WASCTC/WASC-19',\ + tag:'OWASP_TOP_10/A1',\ + tag:'OWASP_AppSensor/CIE1',\ + tag:'PCI/6.5.2',\ + tag:'paranoia-level/3',\ + ver:'OWASP_CRS/3.2.0',\ + severity:'CRITICAL',\ + setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ + setvar:'tx.anomaly_score_pl3=+%{tx.critical_anomaly_score}'" + + +# +# -=[ Detect SQLi bypass: quotes ]=- +# +# Quotes and backticks can be used to bypass SQLi detection. +# +# Example: +# GET http://localhost/test.php?id=9999%20or+{`if`(2=(select+2+from+wp_users+where+user_login='admin'))} +# +# The minimum text between the ticks or backticks must be 2 (if, for example) and a maximum of 29. +# 29 is a compromise: The lower this number (29), the lower the probability of FP and the higher the probability of false negatives. +# In tests we got a minimum number of FP with {2,29}. +# +# Base64 encoding detection: +# (?:[A-Za-z0-9+/]{4})+ #match any number of 4-letter blocks of the base64 char set +# (?:[A-Za-z0-9+/]{2}== #match 2-letter block of the base64 char set followed by "==", together forming a 4-letter block +# | # or +# [A-Za-z0-9+/]{3}= #match 3-letter block of the base64 char set followed by "=", together forming a 4-letter block +# )? +# +# The minimal string that triggers this regexp is: 'if' +# +# The rule 942511 is related to 942110 which catches a single ' or ` +# +# The rule 942510 is similar to this rule, but triggers on backticks +# (`if`). That rule runs in paranoia level 2 or higher since the risk of +# false positives in natural text is still present but lower than this +# rule. +# +SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?:'((?:[\w\s=_\-+{}()<@]){2,29}|(?:[A-Za-z0-9+\/]{4})+(?:[A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=)?)')" \ + "id:942511,\ + phase:2,\ + block,\ + capture,\ + t:none,t:urlDecodeUni,\ + msg:'SQLi bypass attempt by ticks detected.',\ + logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\ + tag:'application-multi',\ + tag:'language-multi',\ + tag:'platform-multi',\ + tag:'attack-sqli',\ + tag:'OWASP_CRS',\ + tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ + tag:'WASCTC/WASC-19',\ + tag:'OWASP_TOP_10/A1',\ + tag:'OWASP_AppSensor/CIE1',\ + tag:'PCI/6.5.2',\ + tag:'paranoia-level/3',\ + ver:'OWASP_CRS/3.2.0',\ + severity:'CRITICAL',\ + setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ + setvar:'tx.anomaly_score_pl3=+%{tx.critical_anomaly_score}'" + SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 4" "id:942017,phase:1,pass,nolog,skipAfter:END-REQUEST-942-APPLICATION-ATTACK-SQLI" SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 4" "id:942018,phase:2,pass,nolog,skipAfter:END-REQUEST-942-APPLICATION-ATTACK-SQLI" # @@ -1521,23 +1672,25 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQU tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ tag:'paranoia-level/4',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'WARNING',\ setvar:'tx.anomaly_score_pl4=+%{tx.warning_anomaly_score}',\ - setvar:'tx.sql_injection_score=+%{tx.warning_anomaly_score}',\ - setvar:'tx.msg=%{rule.msg}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/RESTRICTED_SQLI_CHARS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.sql_injection_score=+%{tx.warning_anomaly_score}'" # # This is a stricter sibling of rule 942430. # +# This rule is also triggered by the following exploit(s): +# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ] +# SecRule ARGS_NAMES|ARGS|XML:/* "@rx ((?:[~!@#\$%\^&\*\(\)\-\+=\{\}\[\]\|:;\"'´’‘`<>][^~!@#\$%\^&\*\(\)\-\+=\{\}\[\]\|:;\"'´’‘`<>]*?){2})" \ "id:942432,\ @@ -1551,18 +1704,17 @@ SecRule ARGS_NAMES|ARGS|XML:/* "@rx ((?:[~!@#\$%\^&\*\(\)\-\+=\{\}\[\]\|:;\"'´ tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-sqli',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\ tag:'WASCTC/WASC-19',\ tag:'OWASP_TOP_10/A1',\ tag:'OWASP_AppSensor/CIE1',\ tag:'PCI/6.5.2',\ tag:'paranoia-level/4',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'WARNING',\ setvar:'tx.anomaly_score_pl4=+%{tx.warning_anomaly_score}',\ - setvar:'tx.sql_injection_score=+%{tx.warning_anomaly_score}',\ - setvar:'tx.msg=%{rule.msg}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/RESTRICTED_SQLI_CHARS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.sql_injection_score=+%{tx.warning_anomaly_score}'" # diff --git a/confs/owasp-crs/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.conf b/confs/owasp-crs/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.conf index 4451c60..b2a166c 100644 --- a/confs/owasp-crs/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.conf +++ b/confs/owasp-crs/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.conf @@ -1,5 +1,5 @@ # ------------------------------------------------------------------------ -# OWASP ModSecurity Core Rule Set ver.3.1.1 +# OWASP ModSecurity Core Rule Set ver.3.2.0 # Copyright (c) 2006-2019 Trustwave and contributors. All rights reserved. # # The OWASP ModSecurity Core Rule Set is distributed under @@ -39,16 +39,15 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-fixation',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SESSION_FIXATION',\ tag:'WASCTC/WASC-37',\ tag:'CAPEC-61',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.session_fixation_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SESSION_FIXATION-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" SecRule ARGS_NAMES "@rx ^(?:jsessionid|aspsessionid|asp\.net_sessionid|phpsession|phpsessid|weblogicsession|session_id|session-id|cfid|cftoken|cfsid|jservsession|jwsession)$" \ @@ -63,21 +62,20 @@ SecRule ARGS_NAMES "@rx ^(?:jsessionid|aspsessionid|asp\.net_sessionid|phpsessio tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-fixation',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SESSION_FIXATION',\ tag:'WASCTC/WASC-37',\ tag:'CAPEC-61',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ chain" SecRule REQUEST_HEADERS:Referer "@rx ^(?:ht|f)tps?://(.*?)\/" \ "capture,\ chain" SecRule TX:1 "!@endsWith %{request_headers.host}" \ - "setvar:'tx.msg=%{rule.msg}',\ - setvar:'tx.session_fixation_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SESSION_FIXATION-%{MATCHED_VAR_NAME}=%{tx.0}'" + "setvar:'tx.session_fixation_score=+%{tx.critical_anomaly_score}',\ + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" SecRule ARGS_NAMES "@rx ^(?:jsessionid|aspsessionid|asp\.net_sessionid|phpsession|phpsessid|weblogicsession|session_id|session-id|cfid|cftoken|cfsid|jservsession|jwsession)$" \ @@ -92,18 +90,17 @@ SecRule ARGS_NAMES "@rx ^(?:jsessionid|aspsessionid|asp\.net_sessionid|phpsessio tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-fixation',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/WEB_ATTACK/SESSION_FIXATION',\ tag:'WASCTC/WASC-37',\ tag:'CAPEC-61',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ chain" SecRule &REQUEST_HEADERS:Referer "@eq 0" \ - "setvar:'tx.msg=%{rule.msg}',\ - setvar:'tx.session_fixation_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SESSION_FIXATION-%{MATCHED_VAR_NAME}=%{tx.0}'" + "setvar:'tx.session_fixation_score=+%{tx.critical_anomaly_score}',\ + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" diff --git a/confs/owasp-crs/REQUEST-944-APPLICATION-ATTACK-JAVA.conf b/confs/owasp-crs/REQUEST-944-APPLICATION-ATTACK-JAVA.conf index cb2dee4..81e8b36 100644 --- a/confs/owasp-crs/REQUEST-944-APPLICATION-ATTACK-JAVA.conf +++ b/confs/owasp-crs/REQUEST-944-APPLICATION-ATTACK-JAVA.conf @@ -1,5 +1,5 @@ # ------------------------------------------------------------------------ -# OWASP ModSecurity Core Rule Set ver.3.1.1 +# OWASP ModSecurity Core Rule Set ver.3.2.0 # Copyright (c) 2006-2019 Trustwave and contributors. All rights reserved. # # The OWASP ModSecurity Core Rule Set is distributed under @@ -12,38 +12,54 @@ # # Many rules check request bodies, use "SecRequestBodyAccess On" to enable it on main modsecurity configuration file. -SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 1" "phase:1,id:944011,nolog,pass,skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA" -SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 1" "phase:2,id:944012,nolog,pass,skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA" +SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 1" "id:944011,phase:1,pass,nolog,skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA" +SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 1" "id:944012,phase:2,pass,nolog,skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA" # # -= Paranoia Level 1 (default) =- (apply only when tx.executing_paranoia_level is sufficiently high: 1 or higher) # +# This rule is also triggered by an Apache Struts exploit: +# [ Apache Struts vulnerability CVE-2017-5638 - Exploit tested: https://github.com/xsscx/cve-2017-5638 ] +# +# This rule is also triggered by an Apache Struts Remote Code Execution exploit: +# [ Apache Struts vulnerability CVE-2017-9791 - Exploit tested: https://www.exploit-db.com/exploits/42324 ] +# +# This rule is also triggered by an Apache Struts Remote Code Execution exploit: +# [ Apache Struts vulnerability CVE-2017-9805 - Exploit tested: https://www.exploit-db.com/exploits/42627 ] +# +# This rule is also triggered by an Oracle WebLogic Remote Command Execution exploit: +# [ Oracle WebLogic vulnerability CVE-2017-10271 - Exploit tested: https://www.exploit-db.com/exploits/43458 ] +# SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \ "@rx java\.lang\.(?:runtime|processbuilder)" \ "id:944100,\ phase:2,\ block,\ + t:none,t:lowercase,\ log,\ msg:'Remote Command Execution: Suspicious Java class detected',\ logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\ - t:none,t:lowercase,\ tag:'application-multi',\ tag:'language-java',\ tag:'platform-multi',\ tag:'attack-rce',\ - tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',\ + tag:'OWASP_CRS',\ + tag:'OWASP_CRS/WEB_ATTACK/JAVA_INJECTION',\ tag:'WASCTC/WASC-31',\ tag:'OWASP_TOP_10/A1',\ tag:'PCI/6.5.2',\ tag:'paranoia-level/1',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/RCE-%{MATCHED_VAR_NAME}=%{MATCHED_VAR}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" +# This rule is also triggered by the following exploit(s): +# [ Apache Struts vulnerability CVE-2017-5638 - Exploit tested: https://github.com/xsscx/cve-2017-5638 ] +# [ Apache Struts vulnerability CVE-2017-9791 - Exploit tested: https://www.exploit-db.com/exploits/42324 ] +# [ Apache Struts vulnerability CVE-2017-9805 - Exploit tested: https://www.exploit-db.com/exploits/42627 ] # [ Java deserialization vulnerability/Apache Struts (CVE-2017-9805) ] # [ Java deserialization vulnerability/Oracle Weblogic (CVE-2017-10271) ] +# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ] # # Generic rule to detect processbuilder or runtime calls, if any of thos is found and the same target contains # java. unmarshaller or base64data to trigger a potential payload execution @@ -62,19 +78,18 @@ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES tag:'language-java',\ tag:'platform-multi',\ tag:'attack-rce',\ - tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',\ + tag:'OWASP_CRS',\ + tag:'OWASP_CRS/WEB_ATTACK/JAVA_INJECTION',\ tag:'WASCTC/WASC-31',\ tag:'OWASP_TOP_10/A1',\ tag:'PCI/6.5.2',\ tag:'paranoia-level/1',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ chain" SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* "@rx (?:unmarshaller|base64data|java\.)" \ - "setvar:'tx.msg=%{rule.msg}',\ - setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/RCE-%{MATCHED_VAR_NAME}=%{MATCHED_VAR}'" + "setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\ + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" # Magic bytes detected and payload included possibly RCE vulnerable classess detected and process execution methods detected # anomaly score set to critical as all conditions indicate the request try to perform RCE. @@ -91,49 +106,56 @@ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES tag:'language-java',\ tag:'platform-multi',\ tag:'attack-rce',\ - tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',\ + tag:'OWASP_CRS',\ + tag:'OWASP_CRS/WEB_ATTACK/JAVA_INJECTION',\ tag:'WASCTC/WASC-31',\ tag:'OWASP_TOP_10/A1',\ tag:'PCI/6.5.2',\ tag:'paranoia-level/1',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ chain" SecRule MATCHED_VARS "@rx (?:runtime|processbuilder)" \ "t:none,t:lowercase,\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/RCE-%{MATCHED_VAR_NAME}=%{MATCHED_VAR}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" -SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \ - "@pmf java-classes.data" \ +# This rule is also triggered by the following exploit(s): +# [ Apache Struts vulnerability CVE-2017-5638 - Exploit tested: https://github.com/mazen160/struts-pwn ] +# [ Apache Struts vulnerability CVE-2017-5638 - Exploit tested: https://github.com/xsscx/cve-2017-5638 ] +# [ Apache Struts vulnerability CVE-2017-9791 - Exploit tested: https://www.exploit-db.com/exploits/42324 ] +# [ Apache Struts vulnerability CVE-2017-9805 - Exploit tested: https://www.exploit-db.com/exploits/42627 ] +# [ Oracle WebLogic vulnerability CVE-2017-10271 - Exploit tested: https://www.exploit-db.com/exploits/43458 ] +# [ Apache Struts vulnerability CVE-2018-11776 - Exploit tested: https://www.exploit-db.com/exploits/45262 ] +# [ Apache Struts vulnerability CVE-2018-11776 - Exploit tested: https://www.exploit-db.com/exploits/45260 ] +# +SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_FILENAME|REQUEST_HEADERS|XML:/*|XML://@* \ + "@pmFromFile java-classes.data" \ "id:944130,\ phase:2,\ block,\ + t:none,t:lowercase,\ log,\ msg:'Suspicious Java class detected',\ logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\ - t:none,t:lowercase,\ tag:'application-multi',\ tag:'language-java',\ tag:'platform-multi',\ tag:'attack-rce',\ - tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',\ + tag:'OWASP_CRS',\ + tag:'OWASP_CRS/WEB_ATTACK/JAVA_INJECTION',\ tag:'WASCTC/WASC-31',\ tag:'OWASP_TOP_10/A1',\ tag:'PCI/6.5.2',\ tag:'paranoia-level/1',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/RCE-%{MATCHED_VAR_NAME}=%{MATCHED_VAR}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" -SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 2" "phase:1,id:944013,nolog,pass,skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA" -SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 2" "phase:2,id:944014,nolog,pass,skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA" +SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 2" "id:944013,phase:1,pass,nolog,skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA" +SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 2" "id:944014,phase:2,pass,nolog,skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA" # # -= Paranoia Level 2 =- (apply only when tx.executing_paranoia_level is sufficiently high: 2 or higher) # @@ -161,17 +183,16 @@ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES tag:'language-java',\ tag:'platform-multi',\ tag:'attack-rce',\ - tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',\ + tag:'OWASP_CRS',\ + tag:'OWASP_CRS/WEB_ATTACK/JAVA_INJECTION',\ tag:'WASCTC/WASC-31',\ tag:'OWASP_TOP_10/A1',\ tag:'PCI/6.5.2',\ tag:'paranoia-level/2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/RCE-%{MATCHED_VAR_NAME}=%{MATCHED_VAR}'" + setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'" # Detecting possibe base64 text to match encoded magic bytes \xac\xed\x00\x05 with padding encoded in base64 strings are rO0ABQ KztAAU Cs7QAF SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \ @@ -186,17 +207,16 @@ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES tag:'language-java',\ tag:'platform-multi',\ tag:'attack-rce',\ - tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',\ + tag:'OWASP_CRS',\ + tag:'OWASP_CRS/WEB_ATTACK/JAVA_INJECTION',\ tag:'WASCTC/WASC-31',\ tag:'OWASP_TOP_10/A1',\ tag:'PCI/6.5.2',\ tag:'paranoia-level/2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/RCE-%{MATCHED_VAR_NAME}=%{MATCHED_VAR}'" + setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'" SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \ "@rx (?:clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder)" \ @@ -211,47 +231,48 @@ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES tag:'language-java',\ tag:'platform-multi',\ tag:'attack-rce',\ - tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',\ + tag:'OWASP_CRS',\ + tag:'OWASP_CRS/WEB_ATTACK/JAVA_INJECTION',\ tag:'WASCTC/WASC-31',\ tag:'OWASP_TOP_10/A1',\ tag:'PCI/6.5.2',\ tag:'paranoia-level/2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/RCE-%{MATCHED_VAR_NAME}=%{MATCHED_VAR}'" + setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'" +# This rule is also triggered by the following exploit(s): +# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ] +# SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \ "@rx java\b.+(?:runtime|processbuilder)" \ "id:944250,\ phase:2,\ block,\ + t:lowercase,\ log,\ msg:'Remote Command Execution: Suspicious Java method detected',\ logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\ - t:lowercase,\ tag:'application-multi',\ tag:'language-java',\ tag:'platform-multi',\ tag:'attack-rce',\ - tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',\ + tag:'OWASP_CRS',\ + tag:'OWASP_CRS/WEB_ATTACK/JAVA_INJECTION',\ tag:'WASCTC/WASC-31',\ tag:'OWASP_TOP_10/A1',\ tag:'PCI/6.5.2',\ tag:'paranoia-level/2',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/RCE-%{MATCHED_VAR_NAME}=%{MATCHED_VAR}'" + setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'" -SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 3" "phase:1,id:944015,nolog,pass,skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA" -SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 3" "phase:2,id:944016,nolog,pass,skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA" +SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 3" "id:944015,phase:1,pass,nolog,skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA" +SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 3" "id:944016,phase:2,pass,nolog,skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA" # # -= Paranoia Level 3 =- (apply only when tx.executing_paranoia_level is sufficiently high: 3 or higher) # @@ -275,21 +296,20 @@ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES tag:'language-java',\ tag:'platform-multi',\ tag:'attack-rce',\ - tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',\ + tag:'OWASP_CRS',\ + tag:'OWASP_CRS/WEB_ATTACK/JAVA_INJECTION',\ tag:'WASCTC/WASC-31',\ tag:'OWASP_TOP_10/A1',\ tag:'PCI/6.5.2',\ tag:'paranoia-level/3',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl3=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/RCE-%{MATCHED_VAR_NAME}=%{MATCHED_VAR}'" + setvar:'tx.anomaly_score_pl3=+%{tx.critical_anomaly_score}'" -SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 4" "phase:1,id:944017,nolog,pass,skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA" -SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 4" "phase:2,id:944018,nolog,pass,skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA" +SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 4" "id:944017,phase:1,pass,nolog,skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA" +SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 4" "id:944018,phase:2,pass,nolog,skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA" # # -= Paranoia Level 4 =- (apply only when tx.executing_paranoia_level is sufficiently high: 4 or higher) # diff --git a/confs/owasp-crs/REQUEST-949-BLOCKING-EVALUATION.conf b/confs/owasp-crs/REQUEST-949-BLOCKING-EVALUATION.conf index 104a650..1f594d4 100644 --- a/confs/owasp-crs/REQUEST-949-BLOCKING-EVALUATION.conf +++ b/confs/owasp-crs/REQUEST-949-BLOCKING-EVALUATION.conf @@ -1,5 +1,5 @@ # ------------------------------------------------------------------------ -# OWASP ModSecurity Core Rule Set ver.3.1.1 +# OWASP ModSecurity Core Rule Set ver.3.2.0 # Copyright (c) 2006-2019 Trustwave and contributors. All rights reserved. # # The OWASP ModSecurity Core Rule Set is distributed under @@ -71,8 +71,7 @@ SecRule IP:REPUT_BLOCK_FLAG "@eq 1" \ severity:'CRITICAL',\ chain" SecRule TX:DO_REPUT_BLOCK "@eq 1" \ - "setvar:'tx.inbound_tx_msg=%{tx.msg}',\ - setvar:'tx.inbound_anomaly_score=%{tx.anomaly_score}'" + "setvar:'tx.inbound_anomaly_score=%{tx.anomaly_score}'" # # -=[ Anomaly Mode: Overall Transaction Anomaly Score ]=- @@ -89,7 +88,6 @@ SecRule TX:ANOMALY_SCORE "@ge %{tx.inbound_anomaly_score_threshold}" \ tag:'platform-multi',\ tag:'attack-generic',\ severity:'CRITICAL',\ - setvar:'tx.inbound_tx_msg=%{tx.msg}',\ setvar:'tx.inbound_anomaly_score=%{tx.anomaly_score}'" diff --git a/confs/owasp-crs/RESPONSE-950-DATA-LEAKAGES.conf b/confs/owasp-crs/RESPONSE-950-DATA-LEAKAGES.conf index 8c75700..cd3eb69 100644 --- a/confs/owasp-crs/RESPONSE-950-DATA-LEAKAGES.conf +++ b/confs/owasp-crs/RESPONSE-950-DATA-LEAKAGES.conf @@ -1,5 +1,5 @@ # ------------------------------------------------------------------------ -# OWASP ModSecurity Core Rule Set ver.3.1.1 +# OWASP ModSecurity Core Rule Set ver.3.2.0 # Copyright (c) 2006-2019 Trustwave and contributors. All rights reserved. # # The OWASP ModSecurity Core Rule Set is distributed under @@ -39,18 +39,51 @@ SecRule RESPONSE_BODY "@rx (?:<(?:TITLE>Index of.*?Index of.*?Inde tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-disclosure',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/LEAKAGE/INFO_DIRECTORY_LISTING',\ tag:'WASCTC/WASC-13',\ tag:'OWASP_TOP_10/A6',\ tag:'PCI/6.5.6',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'ERROR',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.error_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/LEAKAGE/INFO-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.error_anomaly_score}'" +# +# -=[ CGI Source Code Leakage ]=- +# +# A CGI script begins normally with #! and the interpreter, +# for example: +# +# #!/usr/bin/perl +# #!/usr/bin/python +# #!/usr/bin/ruby +# +# If the CGI script processors or MIME type handlers are misconfigured, +# the script's source code could be erroneously returned to the client. +SecRule RESPONSE_BODY "@rx ^#\!\s?/" \ + "id:950140,\ + phase:4,\ + block,\ + capture,\ + t:none,\ + msg:'CGI source code leakage',\ + logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\ + tag:'application-multi',\ + tag:'language-multi',\ + tag:'platform-multi',\ + tag:'attack-disclosure',\ + tag:'OWASP_CRS',\ + tag:'OWASP_CRS/LEAKAGE/SOURCE_CODE_CGI',\ + tag:'WASCTC/WASC-13',\ + tag:'OWASP_TOP_10/A6',\ + tag:'PCI/6.5.6',\ + ctl:auditLogParts=+E,\ + ver:'OWASP_CRS/3.2.0',\ + severity:'ERROR',\ + setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}',\ + setvar:'tx.anomaly_score_pl1=+%{tx.error_anomaly_score}'" SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 2" "id:950013,phase:3,pass,nolog,skipAfter:END-RESPONSE-950-DATA-LEAKAGES" @@ -79,12 +112,10 @@ SecRule RESPONSE_STATUS "@rx ^5\d{2}$" \ tag:'PCI/6.5.6',\ tag:'paranoia-level/2',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'ERROR',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.outbound_anomaly_score_pl2=+%{tx.error_anomaly_score}',\ - setvar:'tx.anomaly_score_pl2=+%{tx.error_anomaly_score}',\ - setvar:'tx.%{rule.id}-AVAILABILITY/APP_NOT_AVAIL-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl2=+%{tx.error_anomaly_score}'" diff --git a/confs/owasp-crs/RESPONSE-951-DATA-LEAKAGES-SQL.conf b/confs/owasp-crs/RESPONSE-951-DATA-LEAKAGES-SQL.conf index 20b5fa1..d53b491 100644 --- a/confs/owasp-crs/RESPONSE-951-DATA-LEAKAGES-SQL.conf +++ b/confs/owasp-crs/RESPONSE-951-DATA-LEAKAGES-SQL.conf @@ -1,5 +1,5 @@ # ------------------------------------------------------------------------ -# OWASP ModSecurity Core Rule Set ver.3.1.1 +# OWASP ModSecurity Core Rule Set ver.3.2.0 # Copyright (c) 2006-2019 Trustwave and contributors. All rights reserved. # # The OWASP ModSecurity Core Rule Set is distributed under @@ -29,13 +29,13 @@ SecRule RESPONSE_BODY "@pmFromFile sql-errors.data" \ "id:951100,\ phase:4,\ pass,\ - nolog,\ t:none,\ + nolog,\ tag:'application-multi',\ tag:'language-multi',\ tag:'platform-multi',\ tag:'attack-disclosure',\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ setvar:'tx.sql_error_match=1'" SecRule TX:sql_error_match "@eq 1" \ @@ -50,19 +50,18 @@ SecRule TX:sql_error_match "@eq 1" \ tag:'language-multi',\ tag:'platform-msaccess',\ tag:'attack-disclosure',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/LEAKAGE/ERRORS_SQL',\ tag:'CWE-209',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ chain" SecRule RESPONSE_BODY "@rx (?i:JET Database Engine|Access Database Engine|\[Microsoft\]\[ODBC Microsoft Access Driver\])" \ "capture,\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" SecRule TX:sql_error_match "@eq 1" \ "id:951120,\ @@ -76,19 +75,18 @@ SecRule TX:sql_error_match "@eq 1" \ tag:'language-multi',\ tag:'platform-oracle',\ tag:'attack-disclosure',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/LEAKAGE/ERRORS_SQL',\ tag:'CWE-209',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ chain" SecRule RESPONSE_BODY "@rx (?i:ORA-[0-9][0-9][0-9][0-9]|java\.sql\.SQLException|Oracle error|Oracle.*Driver|Warning.*oci_.*|Warning.*ora_.*)" \ "capture,\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" SecRule TX:sql_error_match "@eq 1" \ "id:951130,\ @@ -102,19 +100,18 @@ SecRule TX:sql_error_match "@eq 1" \ tag:'language-multi',\ tag:'platform-db2',\ tag:'attack-disclosure',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/LEAKAGE/ERRORS_SQL',\ tag:'CWE-209',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ chain" SecRule RESPONSE_BODY "@rx (?i:DB2 SQL error:|\[IBM\]\[CLI Driver\]\[DB2/6000\]|CLI Driver.*DB2|DB2 SQL error|db2_\w+\()" \ "capture,\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" SecRule TX:sql_error_match "@eq 1" \ "id:951140,\ @@ -128,19 +125,18 @@ SecRule TX:sql_error_match "@eq 1" \ tag:'language-multi',\ tag:'platform-emc',\ tag:'attack-disclosure',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/LEAKAGE/ERRORS_SQL',\ tag:'CWE-209',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ chain" SecRule RESPONSE_BODY "@rx (?i:\[DM_QUERY_E_SYNTAX\]|has occurred in the vicinity of:)" \ "capture,\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" SecRule TX:sql_error_match "@eq 1" \ "id:951150,\ @@ -154,19 +150,18 @@ SecRule TX:sql_error_match "@eq 1" \ tag:'language-multi',\ tag:'platform-firebird',\ tag:'attack-disclosure',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/LEAKAGE/ERRORS_SQL',\ tag:'CWE-209',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ chain" SecRule RESPONSE_BODY "@rx (?i)Dynamic SQL Error" \ "capture,\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" SecRule TX:sql_error_match "@eq 1" \ @@ -181,19 +176,18 @@ SecRule TX:sql_error_match "@eq 1" \ tag:'language-multi',\ tag:'platform-frontbase',\ tag:'attack-disclosure',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/LEAKAGE/ERRORS_SQL',\ tag:'CWE-209',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ chain" SecRule RESPONSE_BODY "@rx (?i)Exception (?:condition )?\d+\. Transaction rollback\." \ "capture,\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" SecRule TX:sql_error_match "@eq 1" \ "id:951170,\ @@ -207,19 +201,18 @@ SecRule TX:sql_error_match "@eq 1" \ tag:'language-multi',\ tag:'platform-hsqldb',\ tag:'attack-disclosure',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/LEAKAGE/ERRORS_SQL',\ tag:'CWE-209',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ chain" SecRule RESPONSE_BODY "@rx (?i)org\.hsqldb\.jdbc" \ "capture,\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" SecRule TX:sql_error_match "@eq 1" \ "id:951180,\ @@ -233,19 +226,18 @@ SecRule TX:sql_error_match "@eq 1" \ tag:'language-multi',\ tag:'platform-informix',\ tag:'attack-disclosure',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/LEAKAGE/ERRORS_SQL',\ tag:'CWE-209',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ chain" SecRule RESPONSE_BODY "@rx (?i:An illegal character has been found in the statement|com\.informix\.jdbc|Exception.*Informix)" \ "capture,\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" SecRule TX:sql_error_match "@eq 1" \ @@ -260,19 +252,18 @@ SecRule TX:sql_error_match "@eq 1" \ tag:'language-multi',\ tag:'platform-ingres',\ tag:'attack-disclosure',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/LEAKAGE/ERRORS_SQL',\ tag:'CWE-209',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ chain" SecRule RESPONSE_BODY "@rx (?i:Warning.*ingres_|Ingres SQLSTATE|Ingres\W.*Driver)" \ "capture,\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" SecRule TX:sql_error_match "@eq 1" \ @@ -287,19 +278,18 @@ SecRule TX:sql_error_match "@eq 1" \ tag:'language-multi',\ tag:'platform-interbase',\ tag:'attack-disclosure',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/LEAKAGE/ERRORS_SQL',\ tag:'CWE-209',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ chain" SecRule RESPONSE_BODY "@rx (?i:Warning: ibase_|Unexpected end of command in statement)" \ "capture,\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" SecRule TX:sql_error_match "@eq 1" \ "id:951210,\ @@ -313,19 +303,18 @@ SecRule TX:sql_error_match "@eq 1" \ tag:'language-multi',\ tag:'platform-maxdb',\ tag:'attack-disclosure',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/LEAKAGE/ERRORS_SQL',\ tag:'CWE-209',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ chain" SecRule RESPONSE_BODY "@rx (?i:SQL error.*POS[0-9]+.*|Warning.*maxdb.*)" \ "capture,\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" SecRule TX:sql_error_match "@eq 1" \ "id:951220,\ @@ -339,19 +328,18 @@ SecRule TX:sql_error_match "@eq 1" \ tag:'language-multi',\ tag:'platform-mssql',\ tag:'attack-disclosure',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/LEAKAGE/ERRORS_SQL',\ tag:'CWE-209',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ chain" SecRule RESPONSE_BODY "@rx (?i)(?:System\.Data\.OleDb\.OleDbException|\[Microsoft\]\[ODBC SQL Server Driver\]|\[Macromedia\]\[SQLServer JDBC Driver\]|\[SqlException|System\.Data\.SqlClient\.SqlException|Unclosed quotation mark after the character string|'80040e14'|mssql_query\(\)|Microsoft OLE DB Provider for ODBC Drivers|Microsoft OLE DB Provider for SQL Server|Incorrect syntax near|Sintaxis incorrecta cerca de|Syntax error in string in query expression|Procedure or function .* expects parameter|Unclosed quotation mark before the character string|Syntax error .* in query expression|Data type mismatch in criteria expression\.|ADODB\.Field \(0x800A0BCD\)|the used select statements have different number of columns|OLE DB.*SQL Server|Warning.*mssql_.*|Driver.*SQL[\-\_\ ]*Server|SQL Server.*Driver|SQL Server.*[0-9a-fA-F]{8}|Exception.*\WSystem\.Data\.SqlClient\.)" \ "capture,\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" SecRule TX:sql_error_match "@eq 1" \ "id:951230,\ @@ -365,19 +353,18 @@ SecRule TX:sql_error_match "@eq 1" \ tag:'language-multi',\ tag:'platform-mysql',\ tag:'attack-disclosure',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/LEAKAGE/ERRORS_SQL',\ tag:'CWE-209',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ chain" SecRule RESPONSE_BODY "@rx (?i)(?:supplied argument is not a valid MySQL|Column count doesn't match value count at row|mysql_fetch_array\(\)|on MySQL result index|You have an error in your SQL syntax;|You have an error in your SQL syntax near|MySQL server version for the right syntax to use|\[MySQL\]\[ODBC|Column count doesn't match|Table '[^']+' doesn't exist|SQL syntax.*MySQL|Warning.*mysql_.*|valid MySQL result|MySqlClient\.)" \ "capture,\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" SecRule TX:sql_error_match "@eq 1" \ "id:951240,\ @@ -391,19 +378,18 @@ SecRule TX:sql_error_match "@eq 1" \ tag:'language-multi',\ tag:'platform-pgsql',\ tag:'attack-disclosure',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/LEAKAGE/ERRORS_SQL',\ tag:'CWE-209',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ chain" - SecRule RESPONSE_BODY "@rx (?i)(?:PostgreSQL query failed:|pg_query\(\) \[:|pg_exec\(\) \[:|PostgreSQL.*ERROR|Warning.*pg_.*|valid PostgreSQL result|Npgsql\.|PG::([a-zA-Z]*)Error|Supplied argument is not a valid PostgreSQL (?:.*?) resource|Unable to connect to PostgreSQL server)" \ + SecRule RESPONSE_BODY "@rx (?i:PostgreSQL query failed:|pg_query\(\) \[:|pg_exec\(\) \[:|PostgreSQL.*ERROR|Warning.*pg_.*|valid PostgreSQL result|Npgsql\.|PG::[a-zA-Z]*Error|Supplied argument is not a valid PostgreSQL .*? resource|Unable to connect to PostgreSQL server)" \ "capture,\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" SecRule TX:sql_error_match "@eq 1" \ "id:951250,\ @@ -417,19 +403,18 @@ SecRule TX:sql_error_match "@eq 1" \ tag:'language-multi',\ tag:'platform-sqlite',\ tag:'attack-disclosure',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/LEAKAGE/ERRORS_SQL',\ tag:'CWE-209',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ chain" SecRule RESPONSE_BODY "@rx (?i)(?:Warning.*sqlite_.*|Warning.*SQLite3::|SQLite/JDBCDriver|SQLite\.Exception|System\.Data\.SQLite\.SQLiteException)" \ "capture,\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" SecRule TX:sql_error_match "@eq 1" \ "id:951260,\ @@ -443,19 +428,18 @@ SecRule TX:sql_error_match "@eq 1" \ tag:'language-multi',\ tag:'platform-sybase',\ tag:'attack-disclosure',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/LEAKAGE/ERRORS_SQL',\ tag:'CWE-209',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'CRITICAL',\ chain" SecRule RESPONSE_BODY "@rx (?i)(?:Sybase message:|Warning.*sybase.*|Sybase.*Server message.*)" \ "capture,\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'" diff --git a/confs/owasp-crs/RESPONSE-952-DATA-LEAKAGES-JAVA.conf b/confs/owasp-crs/RESPONSE-952-DATA-LEAKAGES-JAVA.conf index 5b7b027..9e4afc1 100644 --- a/confs/owasp-crs/RESPONSE-952-DATA-LEAKAGES-JAVA.conf +++ b/confs/owasp-crs/RESPONSE-952-DATA-LEAKAGES-JAVA.conf @@ -1,5 +1,5 @@ # ------------------------------------------------------------------------ -# OWASP ModSecurity Core Rule Set ver.3.1.1 +# OWASP ModSecurity Core Rule Set ver.3.2.0 # Copyright (c) 2006-2019 Trustwave and contributors. All rights reserved. # # The OWASP ModSecurity Core Rule Set is distributed under @@ -34,17 +34,16 @@ SecRule RESPONSE_BODY "@pmFromFile java-code-leakages.data" \ tag:'language-java',\ tag:'platform-multi',\ tag:'attack-disclosure',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/LEAKAGE/SOURCE_CODE_JAVA',\ tag:'WASCTC/WASC-13',\ tag:'OWASP_TOP_10/A6',\ tag:'PCI/6.5.6',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'ERROR',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.error_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/LEAKAGE/SOURCE_CODE-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.error_anomaly_score}'" # # -=[ Java Errors ]=- @@ -63,17 +62,16 @@ SecRule RESPONSE_BODY "@pmFromFile java-errors.data" \ tag:'language-java',\ tag:'platform-multi',\ tag:'attack-disclosure',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/LEAKAGE/ERRORS_JAVA',\ tag:'WASCTC/WASC-13',\ tag:'OWASP_TOP_10/A6',\ tag:'PCI/6.5.6',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'ERROR',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.error_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.error_anomaly_score}'" diff --git a/confs/owasp-crs/RESPONSE-953-DATA-LEAKAGES-PHP.conf b/confs/owasp-crs/RESPONSE-953-DATA-LEAKAGES-PHP.conf index e223f5e..ec143bc 100644 --- a/confs/owasp-crs/RESPONSE-953-DATA-LEAKAGES-PHP.conf +++ b/confs/owasp-crs/RESPONSE-953-DATA-LEAKAGES-PHP.conf @@ -1,5 +1,5 @@ # ------------------------------------------------------------------------ -# OWASP ModSecurity Core Rule Set ver.3.1.1 +# OWASP ModSecurity Core Rule Set ver.3.2.0 # Copyright (c) 2006-2019 Trustwave and contributors. All rights reserved. # # The OWASP ModSecurity Core Rule Set is distributed under @@ -22,7 +22,7 @@ SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 1" "id:953012,phase:4,pass,nolog,skipAf # # -=[ PHP Error Message Leakage ]=- # -SecRule RESPONSE_BODY "@pmf php-errors.data" \ +SecRule RESPONSE_BODY "@pmFromFile php-errors.data" \ "id:953100,\ phase:4,\ block,\ @@ -34,17 +34,16 @@ SecRule RESPONSE_BODY "@pmf php-errors.data" \ tag:'language-php',\ tag:'platform-multi',\ tag:'attack-disclosure',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/LEAKAGE/ERRORS_PHP',\ tag:'WASCTC/WASC-13',\ tag:'OWASP_TOP_10/A6',\ tag:'PCI/6.5.6',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'ERROR',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.error_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.error_anomaly_score}'" # # -=[ PHP source code leakage ]=- @@ -63,17 +62,16 @@ SecRule RESPONSE_BODY "@rx (?:\b(?:f(?:tp_(?:nb_)?f?(?:ge|pu)t|get(?:s?s|c)|scan tag:'language-php',\ tag:'platform-multi',\ tag:'attack-disclosure',\ + tag:'OWASP_CRS',\ tag:'OWASP_CRS/LEAKAGE/SOURCE_CODE_PHP',\ tag:'WASCTC/WASC-13',\ tag:'OWASP_TOP_10/A6',\ tag:'PCI/6.5.6',\ ctl:auditLogParts=+E,\ - ver:'OWASP_CRS/3.1.1',\ + ver:'OWASP_CRS/3.2.0',\ severity:'ERROR',\ - setvar:'tx.msg=%{rule.msg}',\ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}',\ - setvar:'tx.anomaly_score_pl1=+%{tx.error_anomaly_score}',\ - setvar:'tx.%{rule.id}-OWASP_CRS/LEAKAGE/SOURCE_CODE-%{MATCHED_VAR_NAME}=%{tx.0}'" + setvar:'tx.anomaly_score_pl1=+%{tx.error_anomaly_score}'" # Detect the presence of the PHP open tag "Warning: No row with the given identifier open_basedir restriction in effect eval()'d code on line diff --git a/confs/owasp-crs/php-function-names-933150.data b/confs/owasp-crs/php-function-names-933150.data index f23f45b..a04fbc4 100644 --- a/confs/owasp-crs/php-function-names-933150.data +++ b/confs/owasp-crs/php-function-names-933150.data @@ -10,6 +10,11 @@ convert_uudecode file_get_contents file_put_contents fsockopen +get_class_methods +get_class_vars +get_defined_constants +get_defined_functions +get_defined_vars gzdecode gzinflate gzuncompress diff --git a/confs/owasp-crs/php-function-names-933151.data b/confs/owasp-crs/php-function-names-933151.data index 4f06601..614f11f 100644 --- a/confs/owasp-crs/php-function-names-933151.data +++ b/confs/owasp-crs/php-function-names-933151.data @@ -218,14 +218,9 @@ gd_info get_browser get_called_class get_class -get_class_methods -get_class_vars get_declared_classes get_declared_interfaces get_declared_traits -get_defined_constants -get_defined_functions -get_defined_vars get_extension_funcs get_headers get_html_translation_table diff --git a/confs/owasp-crs/restricted-files.data b/confs/owasp-crs/restricted-files.data index d49abd1..3a7fc18 100644 --- a/confs/owasp-crs/restricted-files.data +++ b/confs/owasp-crs/restricted-files.data @@ -3,7 +3,7 @@ .htaccess .htdigest .htpasswd -# dotfiles (keep in sync with lfi-os-files.data) +# home level dotfiles (keep in sync with lfi-os-files.data) .aptitude/config .bash_config .bash_history @@ -107,10 +107,39 @@ wp-config.txt /packages.json # dotenv /.env -/.env # OSX /.DS_Store # WS FTP /.ws_ftp.ini # common, old network config file .netrc +# New Top Level dotfiles +.thunderbird/ +.vmware/ +.kube/ +.java/ +.anydesk/ +.docker/ +.npm/ +.nvm/ +.minikube/ +.atom/ +.aws/config +.aws/credentials +.cups/ +.dbus/ +.boto +.gem/ +.gnonme/ +.gsutil/ +# New Per-Project Files +.idea +nbproject/ +bower.json +.bowerrc +.eslintrc +.jshintrc +.gitlab-ci.yml +.travis.yml +database.yml +Dockerfile diff --git a/confs/owasp-crs/scanners-user-agents.data b/confs/owasp-crs/scanners-user-agents.data index 2c8bf1e..d2d3406 100644 --- a/confs/owasp-crs/scanners-user-agents.data +++ b/confs/owasp-crs/scanners-user-agents.data @@ -61,6 +61,9 @@ floodgate # "F-Secure Radar is a turnkey vulnerability scanning and management platform." F-Secure Radar get-minimal +# Scanner that looks for existing or hidden web objects +# https://github.com/OJ/gobuster +gobuster # vuln scanner gootkit auto-rooter scanner grabber @@ -77,6 +80,8 @@ internet ninja jaascois # vuln scanner zmeu +# "Mozilla/5.0 Jorgee", vuln scanner +Jorgee # port scanner # https://github.com/robertdavidgraham/masscan masscan @@ -137,6 +142,8 @@ sqlmap # sql injection # http://sqlninja.sourceforge.net/ sqlninja +# https://www.cyber.nj.gov/threat-profiles/trojan-variants/sysscan +sysscan # password cracker # http://foofus.net/goons/jmk/medusa/medusa.html teh forest lobster @@ -193,3 +200,6 @@ struts-pwn # Detectify website vulnerability scanner # https://detectify.com/ Detectify +# ZGrab scanner (Mozilla/5.0 zgrab/0.x) +# https://zmap.io +zgrab diff --git a/confs/owasp-crs/sql-function-names.data b/confs/owasp-crs/sql-function-names.data deleted file mode 100644 index 66f1ed8..0000000 --- a/confs/owasp-crs/sql-function-names.data +++ /dev/null @@ -1,236 +0,0 @@ -abs -acos -adddate -addtime -aes_decrypt -aes_encrypt -ascii -asciistr -asin -atan -atan2 -avg -benchmark -bin -bin_to_num -bit_and -bit_count -bit_length -bit_or -bit_xor -cast -ciel -cieling -char_length -char -character_length -charset -chr -coalesce -coercibility -collation -compress -concat_ws -concat -connection_id -conv -convert_tz -convert -cos -cot -count -dcount -cr32 -curdate -current_date -current_time -current_timestamp -current_user -curtime -database -date -date_add -date_format -date_sub -datediff -day -dayname -dayofmonth -dayofweek -dayofyear -decode -default -degrees -des_decrypt -des_encrypt -dump -elt -encode -encrypt -exp -export_set -extract -extractvalue -field -field_in_set -find_in_set -floor -format -found_rows -from_base64 -from_days -from_unixtime -get_format -get_lock -greatest -group_concat -hex -hextoraw -rawtohex -hour -if -ifnull -in -inet6_aton -inet6_ntoa -inet_aton -inet_ntoa -insert -instr -interval -isnull -is_free_lock -is_ipv4_compat -is_ipv4_mapped -is_ipv4 -is_ipv6 -is_not_null -is_not -is_null -is_used_lock -last -last_day -last_inser_id -lcase -least -left -length -ln -load_file -local -localtimestamp -locate -log -log2 -log10 -lower -lpad -ltrim -make_set -makedate -master_pos_wait -max -md5 -microsecond -mid -min -minute -mod -month -monthname -name_const -not_in -now -nullif -oct -octet_length -old_password -ord -password -period_add -period_diff -pi -position -pow -power -procedure_analyse -quarter -quote -radians -rand -release_lock -repeat -replace -reverse -right -round -row_count -rpad -rtrim -schema -sec_to_time -second -session_user -sha -sha1 -sha2 -sign -sin -pg_sleep -sleep -soundex -space -sqrt -std -stddev_pop -stddev_samp -str_to_date -strcmp -subdate -substring -substring_index -substr -subtime -sum -sysdate -system_user -tan -time -timestamp -timestampadd -timestampdiff -timediff -time_format -time_to_sec -to_base64 -todays -toseconds -tochar -tonchar -trim -truncate -ucase -uncompress -uncompressed_length -unhex -unix_timestamp -updatexml -upper -user -utc_date -utc_time -utc_timestamp -uuid -uuid_short -values -var_pop -var_samp -variance -version -week -weekday -weekofyear -weight_string -year -yearweek -xmltype diff --git a/confs/owasp-crs/unix-shell.data b/confs/owasp-crs/unix-shell.data index 1c94f87..9a09ca8 100644 --- a/confs/owasp-crs/unix-shell.data +++ b/confs/owasp-crs/unix-shell.data @@ -1,3 +1,21 @@ +${CDPATH} +${DIRSTACK} +${HOME} +${HOSTNAME} +${IFS} +${OLDPWD} +${OSTYPE} +${PATH} +${PWD} +$CDPATH +$DIRSTACK +$HOME +$HOSTNAME +$IFS +$OLDPWD +$OSTYPE +$PATH +$PWD bin/bash bin/cat bin/csh @@ -7,6 +25,7 @@ bin/echo bin/grep bin/less bin/ls +bin/mknod bin/more bin/nc bin/ps @@ -32,6 +51,9 @@ etc/shadow etc/shells etc/spwd.db proc/self/ +usr/bin/awk +usr/bin/base64 +usr/bin/cat usr/bin/cc usr/bin/clang usr/bin/clang++ @@ -42,31 +64,46 @@ usr/bin/fetch usr/bin/file usr/bin/find usr/bin/ftp +usr/bin/gawk usr/bin/gcc usr/bin/head +usr/bin/hexdump usr/bin/id usr/bin/less +usr/bin/ln +usr/bin/mkfifo usr/bin/more usr/bin/nc +usr/bin/ncat usr/bin/nice usr/bin/nmap usr/bin/perl usr/bin/php usr/bin/php5 usr/bin/php7 +usr/bin/php-cgi +usr/bin/printf +usr/bin/psed usr/bin/python usr/bin/python2 usr/bin/python3 usr/bin/ruby +usr/bin/sed +usr/bin/socat usr/bin/tail +usr/bin/tee +usr/bin/telnet usr/bin/top usr/bin/uname usr/bin/wget usr/bin/who usr/bin/whoami usr/bin/xargs +usr/bin/xxd +usr/bin/yes usr/local/bin/bash usr/local/bin/curl +usr/local/bin/ncat usr/local/bin/nmap usr/local/bin/perl usr/local/bin/php diff --git a/confs/server.conf b/confs/server.conf index d038e50..f7535b2 100644 --- a/confs/server.conf +++ b/confs/server.conf @@ -22,5 +22,5 @@ server { %BLOCK_TOR_EXIT_NODE% %COOKIE_FLAGS% %ERRORS% - include /confs/*.conf; + include /server-confs/*.conf; } diff --git a/entrypoint.sh b/entrypoint.sh index a1ab050..df40035 100644 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -55,8 +55,9 @@ PHP_ALLOW_URL_FOPEN="${PHP_ALLOW_URL_FOPEN-no}" PHP_ALLOW_URL_INCLUDE="${PHP_ALLOW_URL_INCLUDE-no}" PHP_FILE_UPLOADS="${PHP_FILE_UPLOADS-yes}" PHP_UPLOAD_MAX_FILESIZE="${PHP_UPLOAD_MAX_FILESIZE-10M}" -PHP_DISABLE_FUNCTIONS="${PHP_DISABLE_FUNCTIONS-system, exec, shell_exec, passthru, phpinfo, show_source, highlight_file, popen, proc_open, fopen_with_path, dbmopen, dbase_open, putenv, chdir, mkdir, rmdir, chmod, rename, filepro, filepro_rowcount, filepro_retrieve, posix_mkfifo}" +PHP_DISABLE_FUNCTIONS="${PHP_DISABLE_FUNCTIONS-system, exec, shell_exec, passthru, phpinfo, show_source, highlight_file, popen, proc_open, fopen_with_path, dbmopen, dbase_open, putenv, filepro, filepro_rowcount, filepro_retrieve, posix_mkfifo}" USE_MODSECURITY="${USE_MODSECURITY-yes}" +USE_MODSECURITY_CRS="${USE_MODSECURITY_CRS-yes}" CONTENT_SECURITY_POLICY="${CONTENT_SECURITY_POLICY-default-src 'self'; frame-ancestors 'none'; form-action 'self'; upgrade-insecure-requests; block-all-mixed-content; sandbox allow-forms allow-same-origin allow-scripts; reflected-xss block; base-uri 'self'; referrer no-referrer}" COOKIE_FLAGS="${COOKIE_FLAGS-* HttpOnly}" SERVE_FILES="${SERVE_FILES-yes}" @@ -224,6 +225,24 @@ fi if [ "$USE_MODSECURITY" = "yes" ] ; then replace_in_file "/etc/nginx/nginx.conf" "%USE_MODSECURITY%" "include /etc/nginx/modsecurity.conf;" + if ls /modsec-confs/*.conf > /dev/null 2>&1 ; then + replace_in_file "/etc/nginx/modsecurity-rules.conf" "%MODSECURITY_INCLUDE_CUSTOM_RULES%" "include /modsec-confs/*.conf" + else + replace_in_file "/etc/nginx/modsecurity-rules.conf" "%MODSECURITY_INCLUDE_CUSTOM_RULES%" "" + fi + if [ "$USE_MODSECURITY_CRS" = "yes" ] ; then + replace_in_file "/etc/nginx/modsecurity-rules.conf" "%MODSECURITY_INCLUDE_CRS%" "include /etc/nginx/owasp-crs.conf" + if ls /modsec-crs-confs/*.conf > /dev/null 2>&1 ; then + replace_in_file "/etc/nginx/modsecurity-rules.conf" "%MODSECURITY_INCLUDE_CUSTOM_CRS%" "include /modsec-crs-confs/*.conf" + else + replace_in_file "/etc/nginx/modsecurity-rules.conf" "%MODSECURITY_INCLUDE_CUSTOM_CRS%" "" + fi + replace_in_file "/etc/nginx/modsecurity-rules.conf" "%MODSECURITY_INCLUDE_CRS_RULES%" "include /etc/nginx/owasp-crs/*.conf" + else + replace_in_file "/etc/nginx/modsecurity-rules.conf" "%MODSECURITY_INCLUDE_CRS%" "" + replace_in_file "/etc/nginx/modsecurity-rules.conf" "%MODSECURITY_INCLUDE_CUSTOM_CRS%" "" + replace_in_file "/etc/nginx/modsecurity-rules.conf" "%MODSECURITY_INCLUDE_CRS_RULES%" "" + fi else replace_in_file "/etc/nginx/nginx.conf" "%USE_MODSECURITY%" "" fi