CODEWITHSUNDEEP
owaspmod-security
Lite
Lite

Reputation: 151

Mod security whitelist, multiple conditions

I've set up mod_security on my server with the Owasp predefined modsec rules.

However, I'm getting a lot of false positive so I've started to set up whitelist rules.

I have a false positive on this url:

http://example.com/fr/share/?u=http%3A%2F%2Fwww.example.com%2Fen%2Ffiles%2Fimgs%2F%3Fpage%3D100%2

with "Multiple URL Encoding Detected","OWASP_CRS/PROTOCOL_VIOLATION/EVASION" due to the rule:

SecRule ARGS  "\%((?!$|\W)|[0-9a-fA-F]{2}|u[0-9a-fA-F]{4})" "phase:2,rev:'2',ver:'OWASP_CRS/2.2.9',maturity:'6',accuracy:'8',t:none,block,msg:'Multiple URL Encoding Detected',id:'1',tag:'OWASP_CRS/PROTOCOL_VIOLATION/EVASION',severity:'4',setvar:'tx.msg=%{rule.msg}',setvar:tx.anomaly_score=+%{tx.warning_anomaly_score},setvar:tx.%{rule.id}-OWASP_CRS/PROTOCOL_VIOLATION/EVASION-%{matched_var_name}=%{matched_var}"

So the main idea for me is to create a rule that still does the check except for the parameters "u" on url starting by /fr/share/?.

I have some hints with :

SecRule ARGS|!ARGS:u ... but how can I combine  the mention where !REQUEST_URI equal to "/fr/share?.*"

Upvotes: 1

Views: 7934

Answers (1)

Barry Pollard
Barry Pollard

Reputation: 45970

So there are several options here.

You could rewrite the rule, and use chaining, to test for multiple conditions (note I've stripped off some of the rule actions for formatting reasons):

  SecRule ARGS  "\%((?!$|\W)|[0-9a-fA-F]{2}|u[0-9a-fA-F]{4})" \
  "phase:2,rev:'2',ver:'OWASP_CRS/2.2.9',maturity:'6',accuracy:'8', \
  t:none,block,msg:'Multiple URL Encoding Detected',id:'1',chain"
    SecRule REQUEST_URI "!@beginsWith /fr/share/" "t:none"

The "chain" action means the rule on the next line must also pass before the actions are taken, so in this case it's checking the REQUEST_URI does not begin with /fr/share.

However this means you've got your own copy of this rule and makes upgrading to future versions of the Core Rule Set more difficult. It's much preferred to leave the original rule in place (which I've looked up and is actually rule id 950109 rather than rule id 1 that you've given so I presume that rule 1 is your copy).

So, to leave the original rule in place, but not have it false alerting you've a few options, detailed below in increasing complexity:

You could disable the whole rule:

SecRuleRemoveById 950109

This should be specified AFTER the rule is defined.

Obviously that's a bit extreme if it's only giving a false positive for one particular URL, parameter combination and means you lose the protection that rule is giving you for the any other url or parameter.

You could disable that rule for just that 'u' parameter:

SecRuleUpdateTargetById 950109 !ARGS:'u'

I think this can be specified before or after that rule is defined but not 100% sure on that.

But this will disable the for ALL 'u' parameters and you only want to disable it for this particular call, so slightly better but still not what you are looking for.

Therefore the best way is to use the ctl action, on a rule which matches the URL, to alter the original rule for that parameter:

SecRule REQUEST_URI "@beginsWith /fr/share/" \
"t:none,id:1,nolog,pass,ctl:ruleRemoveTargetById=950109;ARGS:u"

An almost identical request to what you are asking for, for rule 981260, is documented here: https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#ctl

Upvotes: 3

Related Questions