ModSecurity: How to whitelist specific cookie name?

Question

I have a false positive involving the content of one of my cookies:

ModSecurity: Warning. Matched "Operator `PmFromFile' with parameter `lfi-os-files.data' against variable `REQUEST_COOKIES:xid' (Value: `ab92d4a54edee30a194329d6bfcf1e%3A%242y%2410%24tvyJRRIx6WJyE3.1XQ%2FWpusT3vkKd8y2g4SuUr.NsrsqEJb%2FLO (3 characters omitted)' ) [file "/etc/nginx/modsec/coreruleset-4.0.0-rc1/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "101"] [id "930120"] [rev ""] [msg "OS File Access Attempt"] [data "Matched Data: .nsr found within REQUEST_COOKIES:xid: ab92d4a54edee30a194329d6bfcf1e:$2y$10$tvyJRRIx6WJyE3.1XQ/WpusT3vkKd8y2g4SuUr.NsrsqEJb/LOuki"] [severity "2"] [ver "OWASP_CRS/4.0.0-rc1"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "***.***.***.***"] [uri "/***/***/*********/*******/"] [unique_id "167009817975.334513"] [ref "o76,4v486,103t:utf8toUnicode,t:urlDecodeUni,t:normalizePathWin"]

It looks like my cookie "xid" is being flagged because the randomly generated encrypted string in the cookie variable contains ".nsr". I solved the underlying issue to prevent cookies like this from being generated in the future. Users who currently have that flagged cookie string will receive a new one on their next page visit, but I still need a rule to allow users to visit the page without a 403 error.

I tried setting up a temporary rule:

SecRule REQUEST_COOKIES "xid" \
    "id:100202,\
    phase:1,\
    pass,\
    nolog,\
    ctl:ruleEngine=DetectionOnly"

Unfortunately, this isn't working. What is the proper SecRule to whitelist a specific cookie name like "xid"?

Thanks

Answer 1

CRS Dev-On-Duty here. You can remove your target REQUEST_COOKIES:xid from the rule 930120 with the following rule exclusion after loading the CRS rules:

SecRuleUpdateTargetById 930120 !REQUEST_COOKIES:xid

If you need more info about Core Rule Set tuning, I recommend the tutorials by our project co-lead Christian Folini: https://www.netnea.com/cms/nginx-tutorial-8_handling-false-positives-modsecurity-core-rule-set/