0

The following search queries are blocked by ModSecurity and returns a 403 forbidden error:

www.example.com/s=zip+someword & www.example.com/s=gzip+someword

but not www.example.com/s=zip & www.example.com/s=gzip

The Apache error_log:

[Sun Jun 20 14:15:51.628805 2021] [:error] [pid 3764:tid 47658554889984] [client xxx.xxx.xxx.xxx:xxxx] [client xxx.xxx.xxx.xxx] ModSecurity: Warning. Pattern match "(?:^|=)\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]*(?:s(?:[\\\\\\\\'\\"]*(?:b[\\\\\\\\'\\"]*_[\\\\\\\\'\\"]*r[\\\\\\\\'\\"]*e[\\\\\\\\'\\"]*l[\\\\\\\\' ..." at ARGS:s. [file "/etc/xxx/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "463"] [id "xxxxxx"] [msg "Remote Command Execution: Direct Unix Command Execution"] [data "Matched Data: zip  found within ARGS:s: zip someword"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "example.com"] [uri "/"] [unique_id "xxxxxxx-xxxxxxxxxxxxxxxxxxx"]

How do make an exception to this ruleset REQUEST-932-APPLICATION-ATTACK-RCE.conf to allow the above queries? I'm not RegEx savvy, and I don't know how to read it.

Improve this question
2
  • What have you tried? Also, what's so secret with the [id "xxxxxx"]?
    – Esa Jokinen
    Commented Jun 20, 2021 at 15:59
  • 1
    I didn't dare to try anything since the website in question is in production, and I am afraid to break it. Concerning the "secret": it just proves my lack of knowledge.
    – skinnedpanda
    Commented Jun 20, 2021 at 16:11

1 Answer 1

Reset to default
0

The Remote Command Execution Rule with the rule id 932150 is triggered by a Unix command followed by a white space. Therefore zip+ and gzip+ trigger the rule, but not zip and gzip alone.

You can tune this rule by partially disabling it for your search input field s. You can write the following tuning rule after your include of the CRS rules in the Apache conf:

SecRuleUpdateTargetById 932150 "!ARGS:s"

With this rule above you remove the check of the argument s from this RCE rule 932150.

A complete guide on how to handle false positives can be found here: https://www.netnea.com/cms/apache-tutorial-8_handling-false-positives-modsecurity-core-rule-set/

Improve this answer
1
  • I first failed to add this rule using the editor in WHM, but then through the command line I created a separate config file that I named "REQUEST-932-APPLICATION-ATTACK-RCE_CUSTOM_EXCEPTION_FOR_WORDPRESS.conf" that I then activated through WHM. Now both searches in my question works.
    – skinnedpanda
    Commented Jun 21, 2021 at 14:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .