1

We have an issue with ModSecurity rule 932150 being triggered when someone searches a site for "ruby red", because (I presume) the rule thinks it's blocking potential Ruby on Rails code.

I found this:

"The Remote Command Execution Rule with the rule id 932150 is triggered by a Unix command followed by a white space. Therefore zip+ and gzip+ trigger the rule, but not zip and gzip alone."

(source: ModSecurity OWASP CRS 3.3.0 false positives on a Wordpress site )

The answer above has example code to disable checks on the argument s, e.g. /search.php?s=ruby+red but I don't want to disable checks on the full s argument. I'd like to only remove 'ruby' from the rule checks, so s is still checked but allows 'ruby'. Is this possible?

1 Answer 1

1

Yes, you can remove the argument s from rule 932150 (ctl:ruleRemoveTargetById=932150;ARGS:s) if the string s contains the word ruby (ARGS:s "@contains ruby"):

SecRule ARGS:s "@contains ruby" \
    "id:10000,t:none,pass,nolog,ctl:ruleRemoveTargetById=932150;ARGS:s"
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .