0

We have an issue with ModSecurity rule 941160 being triggered by the WordPress feature legacy-widget-preview because the request to upload an image file into the widget matches "<img src="

The ModSecurity log file has this:

Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client XXX.XXX.XXX.XXX] ModSecurity: Warning. Pattern match "(?i:(?:<\\\\\\\\w[\\\\\\\\s\\\\\\\\S]*[\\\\\\\\s\\\\\\\\/]|['\\\\"](?:[\\\\\\\\s\\\\\\\\S]*[\\\\\\\\s\\\\\\\\/])?)(?:on(?:d(?:e(?:vice(?:(?:orienta|mo)tion|proximity|found|light)|livery(?:success|error)|activate)|r(?:ag(?:e(?:n(?:ter|d)|xit)|(?:gestur|leav)e|start|drop|over)|op)|i(?:s(?:c(?:hargingtimechange ..." at ARGS:legacy-widget-preview[instance][raw][text]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "199"] [id "941160"] [msg "NoScript XSS InjectionChecker: HTML Injection"] [data "Matched Data: <img src= found within ARGS:legacy-widget-preview[instance][raw][text]: fg<img src=\\\\x22https://XXXXXXXXX.DE/wp-content/uploads/2021/09/LMakr-0gQrGv.png\\\\x22 alt=\\\\x22\\\\x22 width=\\\\x22300\\\\x22 height=\\\\x22300\\\\x22 class=\\\\x22alignnone size-full wp-image-680\\\\x22 />"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "XXXXXXXXX.DE"] [uri "/wp-admin/widgets.php"] [unique_id "YVI58h7F-ItLX29cwjsTQAAzAI"]

I presume the key part here is:

Matched Data: <img src= found within ARGS:legacy-widget-preview[instance][raw][text]

I have attempted to write a ModSecurity rule (below) but it's not at a working point yet. I'm stuck on the last line and I'd really appreciate if someone can advise how it should be written?

#This creates an exception to the rule excluding this phrase
SecRule REQUEST_LINE "@contains /wp-admin/widgets.php?legacy-widget-preview%5BidBase%5D=text&legacy-widget-preview%5Binstance%5D%5Bencoded" \
    "id:10001,\
    phase:1,\
    pass,\
    t:none,\
    msg:'modsec2.whitelist.conf exemption',\
    log,\
    ctl:ruleRemoveTargetById=941160;ARGS:text,\
    ctl:ruleRemoveTargetById=941160;REQUEST_HEADERS:'<img src='\"```
1
  • I found an answer to a similar question that suggests it may just be the "src" that is being blocked. That answer is about a different ModSecurity rule. I reviewed rule 941160 and it doesn't include either 'src' or 'img'. At least not in plain text. There's a lot of syntax I do not understand and I'm unsure how to test it further. Is it best practice to find the exact ARGS required for ctl:ruleRemoveTargetById=941160 in my rule? Could I just add an "allow,\" line to let the request through?
    – Peter
    Sep 29, 2021 at 20:25

1 Answer 1

1

Do you have the CRS WordPress rule exclusions enabled? Those handle WordPress-specific false positives with the CRS. That is a good place to start, if you haven't already done that.

I'm not sure you want to be looking at ARGS:text or the REQUEST_HEADERS collection. You were correct with what you initially said: looking at the log sample, the variable you're interested in is ARGS:legacy-widget-preview[instance][raw][text].

Based on that log entry, a rule exclusion applying to all locations might look like so:

#
# -- CRS Rule Exclusion: 941160 - NoScript XSS InjectionChecker: HTML Injection
#
# Disable rule for the legacy-widget-preview due to issues when uploading an
# image file into the widget
#
SecRuleUpdateTargetById 941160 !ARGS:legacy-widget-preview[instance][raw][text]

That would need to be placed after the Include directive that includes the Core Rule Set.

Alternatively, a rule exclusion applying to only to the /wp-admin/widgets.php location might look like so:

#
# -- CRS Rule Exclusion: 941160 - NoScript XSS InjectionChecker: HTML Injection
#
# Disable rule for the legacy-widget-preview due to issues when uploading an
# image file into the widget
#
SecRule REQUEST_FILENAME "@endsWith /wp-admin/widgets.php" \
    "id:1001,\
    phase:1,\
    pass,\
    t:none,\
    nolog,\
    ctl:ruleRemoveTargetById=941160;ARGS:legacy-widget-preview[instance][raw][text]"

That would need to be placed before the Include directive that includes the Core Rule Set.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .