1

Following are the two Rules taken from ModSecurity CRS core Ruleset. These two rules are base Rules for XSS attacks. If we look at these two rules their variables and actions are same what they differ in their regular expression i.e. \bgetparentfolder\b" and \bonmousedown\b\W*?\=" and found huge number of such rules. Is this a redundancy ? Can i combine these rules i.e single Regular expression?

SecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "\bgetparentfolder\b" \ "phase:2,rev:'2.2.4',capture,t:none,t:htmlEntityDecode,t:compressWhiteSpace,t:lowercase,ctl:auditLogParts=+E,block,msg:'Cross-site Scripting (XSS) Attack',id:'958016',tag:'WEB_ATTACK/XSS',tag:'WASCTC/WASC-8',tag:'WASCTC/WASC-22',tag:'OWASP_TOP_10/A2',tag:'OWASP_AppSensor/IE1',tag:'PCI/6.5.1',logdata:'%{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.xss_score=+%{tx.critical_anomaly_score},setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-WEB_ATTACK/XSS-%{matched_var_name}=%{tx.0}"

SecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* "\bonmousedown\b\W*?\=" \ "phase:2,rev:'2.2.4',capture,t:none,t:htmlEntityDecode,t:compressWhiteSpace,t:lowercase,ctl:auditLogParts=+E,block,msg:'Cross-site Scripting (XSS) Attack',id:'958414',tag:'WEB_ATTACK/XSS',tag:'WASCTC/WASC-8',tag:'WASCTC/WASC-22',tag:'OWASP_TOP_10/A2',tag:'OWASP_AppSensor/IE1',tag:'PCI/6.5.1',logdata:'%{TX.0}',severity:'2',setvar:'tx.msg=%{rule.msg}',setvar:tx.xss_score=+%{tx.critical_anomaly_score},setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-WEB_ATTACK/XSS-%{matched_var_name}=%{tx.0}"

Improve this question
1
  • Nope, I was thinking the same thing when I have measured performance of mod_security. These rules as they are they seems to be quite OK, and you might just select the revelant ones and dont use all of them, or use multi-stage scanning with more machines.
    – Andrew Smith
    Commented Aug 2, 2012 at 16:25

1 Answer 1

Reset to default
1

Well, the way I read the difference between those two regular expressions,

\bgetparentfolder\b

\bonmousedown\b\W*?\=

is that the first one is just matching the string "getparentfolder", while the second one is matching the string "onmousedown" appended with anything but letters, digits, and underscores, lazily matching the previous item (the appended character) zero or more times. I believe this would match both ways of using the onmousedown javascript event:

In HTML:

<element onmousedown="SomeJavaScriptCode">

In JavaScript:

object.onmousedown="SomeJavaScriptCode"

This page from the ebook ModSecurity 2.5 mentions how onmousedown could be used in an XSS attack.

Oh, and as for the first of those regexes, "\bgetparentfolder\b", I don't find it in any Javascript or JScript references, but after Googling it, I can see that functions and methods of that name appear in a number of languages, like VBScript, for example.

So it is clear that the two rules are looking for very different implementations of the same class of attack (XSS). So I think it would not make sense to combine them into a single rule with a single, combined regex.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .