CODEWITHSUNDEEP
mod-securitymod-security2
raise_sec
raise_sec

Reputation: 1

Allow Mod-Security for request uri

I am trying to add exemption for Mod-security rule  in REQUEST-900-before file for the following request :- 
`1668035916.075452 [00] [client 127.0.0.1] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:[\"'`](?:;?\\s*?(?:having|select|union)\\b\\s*?[^\\s]|\\s*?!\\s*?[\"'`\\w])|(?:c(?:onnection_id|urrent_user)|database)\\s*?\\([^\\)]*?|u(?:nion(?:[\\w(\\s]*?select| select @)|ser\\s*?\\([^\\)]*?)|s(?:chema\\s*?\\([^\\)]*?|elect.*?\\w?user\\()|in ..." at ARGS:queryEditor. [file "/etc/modsecurity/owasp-modsecurity-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "183"] [id "942190"] [msg "Detects MSSQL code execution and information gathering attempts"] [data "Matched Data: \x22SELECT . found within ARGS:queryEditor: {\x22title\x22:\x22Untitled Query 1\x22,\x22dbId\x22:null,\x22schema\x22:null,\x22autorun\x22:false,\x22sql\x22:\x22SELECT ...\x22,\x22queryLimit\x22:1000}"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [hostname "a938b1191f37"] [uri "http://iq.haproxy.xyz/tabstateview/"] [unique_id "0A000806:E240_AC110002:01BB_636C354C_0033:0024"]`

Is there any-way of just saying to Mod-security allow this request

I have tried this : -
`SecRule REQUEST_URI "^http://iq\.haproxy\.xyz/tabstateview/$" \
    "id:1000,\
    phase:2,\
    pass,\
    nolog,\
    ctl:ruleRemoveTargetById=942190;ARGS:queryEditor"`

Not able to make it work

Upvotes: 0

Views: 622

Answers (1)

azurit
azurit

Reputation: 134

REQUEST_URI does NOT contain a domain name, see: https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)#request_uri

If you want an exclusion rule that si tied also to the domain name, i suggest this rule:

SecRule SERVER_NAME "@streq iq.haproxy.xyz" \
    "id:1000,\
    phase:1,\
    pass,\
    t:none,\
    nolog,\
    chain"
    SecRule REQUEST_FILENAME "@streq /tabstateview/" \
        "t:none,\
        ctl:ruleRemoveTargetById=942190;ARGS:queryEditor"

Upvotes: 0

Related Questions