ModSecurity: How to write exclusion rules for list of REQUEST_URIs on separate domain names?

Question

I have a server with 100 domain names. On each domain name, I have a unique list of pages/directories that I would like to whitelist (put ModSecurity into DetectionOnly mode temporarily). Basically, how would I write the rule for something like this where there is a set of URLs for abc.com and a set of URLs on xyz.com?:

SecRule REQUEST_DOMAINNAME "abc.com" REQUEST_URI "@pm /account/bulk-upload.php /account/bulk-upload/ /account/edit-account.php /account/reply-or-delete.php /contact.php /contact/ /edit/ /edit-images/ /feedback/leave-feedback.php /feedback/feedback-reply.php /img/ /login.php /maintenance/ /register.php /sell/ /store/add-categories.php /store/edit-store.php" \
    "id:100002,\
    phase:1,\
    t:none,\
    pass,\
    nolog,\
    ctl:ruleEngine=DetectionOnly"

SecRule REQUEST_DOMAINNAME "xyz.com" REQUEST_URI "@pm /account/bulk-upload.php /maintenance.php /edit/ /account/ /register.php /login.php /img/ /contact/ /contact-us.php" \
    "id:100003,\
    phase:1,\
    t:none,\
    pass,\
    nolog,\
    ctl:ruleEngine=DetectionOnly"

I am fairly inexperienced with ModSecurity rule writing, still learning. But is @pm the most efficient way to apply the same rule to a list of various PHP pages and full directories (which contain multiple PHP pages)? If not, what would be a better way to write this rule?

Answer 1

CRS Dev-On-Duty here. Unfortunately REQUEST_DOMAINNAME does not exist, but you can use REQUEST_HEADERS:Host. I think you'll have the information there. Next problem we have to solve is that you can't add multiple variables to one rule. We have to chain them.

You can try if something like this works for you:

SecRule REQUEST_HEADERS:Host "@pm localhost xyz" \
    "id:10000,\
    phase:1,\
    pass,\
    nolog,\
    chain"
    SecRule REQUEST_URI "@pm /account/bulk-upload.php /account/bulk-upload/" \
       "ctl:ruleEngine=DetectionOnly"

Explanation: First we check the REQUEST_HEADERS:Host against this list. And then we chain this rule with the rule that checks for your REQUEST_URI list.