1

I've this error:

ModSecurity: Warning. Matched "Operator `PmFromFile' with parameter `lfi-os-files.data' against variable `ARGS:scope' (Value: `email profile https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/useri (16 characters omitted)' ) [file "/usr/local/owasp-modsecurity-crs-3.0.2/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "84"] [id "930120"] [rev "4"] [msg "OS File Access Attempt"] [data "Matched Data: .profile found within ARGS:scope: email profile https:/www.googleapis.com/auth/userinfo.profile https:/www.googleapis.com/auth/userinfo.email openid"] [severity "2"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "OWASP_CRS/WEB_ATTACK/FILE_INJECTION"] [tag "WASCTC/WASC-33"] [tag "OWASP_TOP_10/A4"] [tag "PCI/6.5.4"] [hostname "a.a.a.a"] [uri "/***/create_account_oauth.php"] [unique_id "159608684932.394214"] [ref "o53,8v144,116t:utf8toUnicode,t:urlDecodeUni,t:normalizePathWin,t:lowercase"

and I've created this exclusion rule for that:

SecRule REQUEST_URI "@beginsWith /***/create_account_oauth.php" \
        "phase:2,log,pass,id:19023,ctl:ruleRemoveById=930120"

what I'd like to do is to refine the exclusion for googleapis only. I'm think chaining the rule with another one to match googleapis in the data field. Is that what you'd recommend? It seems difficult to find resource on chaining. Can someone please help? Thank you.

2
  • I think you should better define your question. Eg. how do you want to catch the "googleapis data field"? And what's your question about the chained rule? Here is a good example (chained rule by 4 rules): github.com/coreruleset/coreruleset/blob/v3.4/dev/rules/…
    – airween
    Nov 3, 2020 at 17:12
  • @airween Question is already well defined, in case someone not understand, does not it mean, its not well explained. Take me positively ;)
    – Tejas Tank
    Apr 28, 2023 at 13:00

1 Answer 1

1

SecRule ARGS:scope "@contains https://www.googleapis.com/auth/userinfo.profile" "id:'9000000',phase:2,t:none,t:lowercase,pass,nolog,ctl:ruleRemoveById=930120"

new mod security rule need to update

which enable google oauth login

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .