1

I'm getting into OWASP CRS with ModSecurity and was investigating the way OWASP calculate the anomaly score in the REQUEST-901-INITIALIZATION.conf they set the following lines :

setvar:'tx.anomaly_score=0',\
setvar:'tx.anomaly_score_pl1=0',\
setvar:'tx.anomaly_score_pl2=0',\
setvar:'tx.anomaly_score_pl3=0',\
setvar:'tx.anomaly_score_pl4=0',\

and in the REQUEST-949-BLOCKING-EVALUATION.conf they do the following :

SecRule TX:PARANOIA_LEVEL "@ge 1" \
    "id:949060,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    setvar:'tx.anomaly_score=+%{tx.anomaly_score_pl1}'"
enter preformatted text here
SecRule TX:PARANOIA_LEVEL "@ge 2" \
"id:949061,\
phase:2,\
pass,\
t:none,\
nolog,\
setvar:'tx.anomaly_score=+%{tx.anomaly_score_pl2}'"

Q1: Of course the paranoia level will be 1, 2, 3 or 4, so why do the "@ge 1"? which will be evaluated on every paranoia level?

Q2: When they do the setVar "setvar:'tx.anomaly_score=+%{tx.anomaly_score_pl2}" the equation will be tx.anomaly_score=tx.anomaly_score+tx.anomaly_score_pl2; is that right ? And how this logically applicable if my request is being validated by multiple rules?

Q3: I would like to have a detailed example of how the OWASP CRS calculate the anomaly score and use it to deny the requests.

0

I try give the answers for your question instead of comment :).

Q1: TX:PARANOIA_LEVEL "@ge 1" means about if TX:PARANOIA_LEVEL >= 1, and all four PL will match. Please read the reason above the rule.

Q2: yes, the += is same as you wrote there. And how this logically applicable if my request is being validated by multiple rules? - the rules evaluated one-by-one, as you (or the rule maker) listed them (grouped by phases). If a rule contains a value giving action like above, then just evaluated - but the TX (or tx) means transaction, so for every request has an own TX collection.

Q3: I think the best start point would be this. It's a bit outdated, but the basics are there. A quick summary: every rule has a severity level, which could be one of the notice (with points 2), warning (3), error (4), critical (5) (these are defined in this file. Every rule activated on different PL (paranoia level), so the chosen score (variable) will incremented by the severity value.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.