1

I'm getting into OWASP CRS with ModSecurity and was investigating the way OWASP calculate the anomaly score in the REQUEST-901-INITIALIZATION.conf they set the following lines:

setvar:'tx.anomaly_score=0',\
setvar:'tx.anomaly_score_pl1=0',\
setvar:'tx.anomaly_score_pl2=0',\
setvar:'tx.anomaly_score_pl3=0',\
setvar:'tx.anomaly_score_pl4=0',\

and in the REQUEST-949-BLOCKING-EVALUATION.conf they do the following:

SecRule TX:PARANOIA_LEVEL "@ge 1" \
    "id:949060,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    setvar:'tx.anomaly_score=+%{tx.anomaly_score_pl1}'"
enter preformatted text here
SecRule TX:PARANOIA_LEVEL "@ge 2" \
"id:949061,\
phase:2,\
pass,\
t:none,\
nolog,\
setvar:'tx.anomaly_score=+%{tx.anomaly_score_pl2}'"

Q1: Of course the paranoia level will be 1, 2, 3 or 4, so why do the "@ge 1"? which will be evaluated on every paranoia level?

Q2: When they do the setVar "setvar:'tx.anomaly_score=+%{tx.anomaly_score_pl2}" the equation will be tx.anomaly_score=tx.anomaly_score+tx.anomaly_score_pl2; is that right ? And how is this logically applicable if my request is being validated by multiple rules?

Q3: I would like to have a detailed example of how the OWASP CRS calculate the anomaly score and use it to deny the requests.

1 Answer 1

0

Q1: TX:PARANOIA_LEVEL "@ge 1" means about if TX:PARANOIA_LEVEL >= 1, and all four PL will match. Please read the reason above the rule.

Q2: yes, the += is same as you wrote there.

And how this logically applicable if my request is being validated by multiple rules?

The rules were evaluated one-by-one, as you (or the rule maker) listed them (grouped by phases). If a rule contains a value-giving action like above, then just evaluated - but the TX (or tx) means transaction, so for every request has its own TX collection.

Q3: I think the best starting point would be this Modsecurity documentation. It's a bit outdated, but the basics are there. A quick summary: every rule has a severity level, which could be one of notice (with points 2), warning (3), error (4), critical (5) (these are defined in this file. Every rule is activated on different PLs (paranoia levels), so the chosen score (variable) will be incremented by the severity value.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .