ModSecurity Command Injection not working

Question

I am testing web application firewall and I have installed ModSecurity 2.9 runs Core ModSecurity Rule Set ver.2.2.9 and to test on Web application I also install DVWA Platform: Windows and trying to do Command Inject and it allows even if I included rules for command inject modsecurity_crs_40_generic_attacks.conf all other rules for SQLinject,XSS etc works fine .

the Rule for Command Inject is as follows

 SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i)(?:;|\{|\||\|\||&|&&|\n|\r|`)\s*[\(,@\'\"\s]*(?:[\w'\"\./]+/|[\\\\'\"\^]*\w[\\\\'\"\^]*:.*\\\\|[\^\.\w '\"/\\\\]*\\\\)?[\"\^]*(?:\.[\"\^]*\w+)?\b" \
        "phase:2,rev:'2',ver:'OWASP_CRS/2.2.9',maturity:'9',accuracy:'8',capture,t:none,t:normalisePath,ctl:auditLogParts=+E,block,msg:'System Command Injection',id:'950907',tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',tag:'WASCTC/WASC-31',tag:'OWASP_TOP_10/A1',tag:'PCI/6.5.2',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION-%{matched_var_name}=%{tx.0},skipAfter:END_COMMAND_INJECTION1"

SecMarker END_COMMAND_INJECTION1

I want to know what can be done so that if I inject a command 127.0.0.1 & shutdown /l or anything after "&" in textbox the ModSecurity must redirect to 403 error page . I have read similar post and solutions if I try my apache server will crash .

Answer 1

Your rule set (2.2.9) is "bit" old, you should use a newer version (actually 3.3).

I don't understand your question exactly "what can be done if I inject...".

As you can see, the operator is the @rx, and it has an argument. The list of variables contains the ARGS, so I guess your form contains an input field, what will evaluated as an argument (member of ARGS). Here I tried to demonstrate how this rule checks your request.

If your rule doesn't triggered, then it means the comparison (your input field with the operator argument) doesn't match, or the engine isn't turned on.

So, please check your SecRuleEngine setting, it must be on On.

My 2 cents: may be the rule misses the t:urlDecode transformation, because if you sent the character &, I assume your browser will send it as encoded form.

Answer 2

If possible update your Modsecurity as @airween said.

If I understand correctly you want blocking directly when detecting such an attack, if this is it:

• Change the disruptive action of the rule from "block" to "deny"

View details: https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-%28v2.x%29#deny