1
ModSecurity 3.0.8
ModSecurity-Nginx 1.0.3
CRS 4.0.0-rc1

I have a marketplace where sellers can list anything for sale. On the "item description" section, we allow users to copy and paste their HTML formatting, like eBay does. We have a lot of sellers who need this feature.

However, when the seller submits their listing, ModSecurity is complaining about seeing the inserted HTML. Temporarily, I have a DetectionOnly exclusion set on /sell/step3.php while I study the false positives, as users complained of their listings being blocked by ModSecurity.

Here is the most recent listing of a guy selling a collectible stamp for sale, with their standard HTML formatting that they use on all their listings:

---LoANlvlP---A--
[10/Nov/2022:20:23:51 +0000] 166811183185.848525 75.167.8.128 58252 ***.***.***.*** 443
---LoANlvlP---B--
POST /sell/step3.php HTTP/2.0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.35
sec-fetch-site: same-origin
content-type: application/x-www-form-urlencoded
origin: https://www.************.com
sec-ch-ua-mobile: ?0
upgrade-insecure-requests: 1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
cache-control: max-age=0
sec-ch-ua: "Microsoft Edge";v="107", "Chromium";v="107", "Not=A?Brand";v="24"
sec-fetch-user: ?1
sec-ch-ua-platform: "Windows"
referer: https://www.************.com/
content-length: 6271
host: www.************.com
sec-fetch-mode: navigate
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
cookie: _aa_main_00923540=923540x7315x44x341817x7277x230; _ga=GA1.2.509941997.1668106789; _gid=GA1.2.2055781097.1668106789; NEWSESSID=o1jk1fpjddvt829dg1oo8i5dqu; __gads=ID=bfd0ad5ec87da1d6-22ebbb97d1d6008d:T=1668109602:RT=1668109602:S=ALNI_MZfPaQ_kbhubJdI9wnm4JICM_AkZw; __gpi=UID=000008f55343334c:T=1668109602:RT=1668109602:S=ALNI_MaTsFE-sox5uuzpkvE3st8YLXG7Og
accept-language: en-US,en;q=0.9
    
---LoANlvlP---F--
HTTP/2.0 200

---LoANlvlP---C--
newitemid=2128489-*****&catid1=20738&catid2=&storecatid=&itemimagesid=2128489-*****&itemtype=new&oldtitle=German+Used+Scott+%23B170+Catalog+Value+%246.00&title=German+Used+Scott+%23B138+Catalog+Value+%243.00&subtitle=&description=%3Cp%3E%3Cspan+style%3D%22font-size%3A28px%3B%22%3E%3Cspan+style%3D%22color%3Argb%28255%2C0%2C0%29%3B%22%3E%3Cstrong%3EGermany+Scott+%23B138+Used%3C%2Fstrong%3E%26nbsp%3B%3C%2Fspan%3E%3C%2Fspan%3E%3C%2Fp%3E%0D%0A%0D%0A%3Cp%3E%3Cspan+style%3D%22font-size%3A22px%3B%22%3E%3Cspan+style%3D%22color%3A%230000CD%3B%22%3E%3Cstrong%3EScott+2023%26nbsp%3BCatalog+Value+%243.00%3C%2Fstrong%3E%3C%2Fspan%3E%3C%2Fspan%3E%3C%2Fp%3E%0D%0A%0D%0A%3Cp+style%3D%22margin%3A0px+0px+10px%3Bcolor%3Argb%2851%2C51%2C51%29%3Bfont-family%3AHelvetica%2C+Arial%2C+sans-serif%3Bfont-size%3A14px%3Bfont-style%3Anormal%3Bfont-weight%3A400%3Bletter-spacing%3Anormal%3Btext-indent%3A0px%3Btext-transform%3Anone%3Bwhite-space%3Anormal%3Bword-spacing%3A0px%3Bbackground-color%3Argb%28255%2C255%2C255%29%3B%22%3E%3Cspan+style%3D%22color%3Argb%28255%2C0%2C0%29%3B%22%3E%3Cspan+style%3D%22font-size%3A20px%3B%22%3E%3Cspan+style%3D%22font-weight%3A700%3B%22%3EMultiple+Buyers+pay+shipping+only+once.%3C%2Fspan%3E%3C%2Fspan%3E%3C%2Fspan%3E%3C%2Fp%3E%0D%0A%0D%0A%3Cdiv+style%3D%22color%3Argb%2851%2C51%2C51%29%3Bfont-family%3AHelvetica%2C+Arial%2C+sans-serif%3Bfont-size%3A14px%3Bfont-style%3Anormal%3Bfont-weight%3A400%3Bletter-spacing%3Anormal%3Btext-indent%3A0px%3Btext-transform%3Anone%3Bwhite-space%3Anormal%3Bword-spacing%3A0px%3Btext-align%3Aleft%3Bbackground-color%3Argb%28255%2C255%2C255%29%3B%22%3E%0D%0A%3Cdiv%3E%0D%0A%3Cdiv%3E%0D%0A%3Ch2+style%3D%22font-family%3Ainherit%3Bfont-weight%3A500%3Bline-height%3A1.1%3Bcolor%3Ainherit%3Bmargin-top%3A20px%3Bmargin-bottom%3A10px%3Bfont-size%3A30px%3B%22%3E%3Ca+style%3D%22background-color%3Atransparent%3Bcolor%3Argb%2851%2C122%2C183%29%3Btext-decoration%3Anone%3B%22%3E%3Cspan+style%3D%22color%3Argb%280%2C0%2C205%29%3B%22%3E%3Cspan+style%3D%22font-weight%3A700%3B%22%3E%3Cspan+style%3D%22border-width%3A0in%3Bmargin%3A0px%3Bpadding%3A0in%3Bfont-family%3AHelvetica%3Bfont-size%3A20pt%3B%22%3EShipping+For+all+stamps+purchased+.75+USA+1.75+World+Wide%3C%2Fspan%3E%3C%2Fspan%3E%3C%2Fspan%3E%3C%2Fa%3E%3C%2Fh2%3E%0D%0A%3C%2Fdiv%3E%0D%0A%0D%0A%3Cp+style%3D%22margin%3A0px+0px+10px%3B%22%3E%3Cspan+style%3D%22color%3Argb%28255%2C0%2C0%29%3B%22%3E%3Cspan+style%3D%22font-size%3A24px%3B%22%3E%3Cspan+style%3D%22font-weight%3A700%3B%22%3EPayPal+Only+if+total+price+is+over+%2410.00+stamps+May+be+combined+to+reach+this+figure.%3C%2Fspan%3E%3C%2Fspan%3E%3C%2Fspan%3E%26nbsp%3B%3Cspan+style%3D%22font-weight%3A700%3B%22%3E%28.60+Charge+if+under+%2410.00%29%3C%2Fspan%3E%3Cspan+style%3D%22color%3Argb%280%2C0%2C128%29%3B%22%3E%3Cspan+style%3D%22font-size%3A20px%3B%22%3E%26nbsp%3B%3C%2Fspan%3E%3C%2Fspan%3E%3C%2Fp%3E%0D%0A%3C%2Fdiv%3E%0D%0A%0D%0A%3Cp+style%3D%22margin%3A0px+0px+10px%3B%22%3E%3Cspan+style%3D%22font-size%3A20px%3B%22%3E%3Cspan+style%3D%22font-weight%3A700%3B%22%3E%3Cspan+style%3D%22color%3Argb%280%2C0%2C205%29%3B%22%3EForeign+Buyers+can+pay+in+new+issue+stamps+from+their+country+at+exchange+rates+listed+in%3C%2Fspan%3E%3Cspan+style%3D%22color%3Argb%28128%2C0%2C128%29%3B%22%3E%26nbsp%3B%3C%2Fspan%3E%3Ca+href%3D%22http%3A%2F%2Fwww.xe.com%2F%22+rel%3D%22nofollow+noreferrer+noopener%22+style%3D%22background-color%3Atransparent%3Bcolor%3Argb%2851%2C122%2C183%29%3Btext-decoration%3Anone%3B%22+target%3D%22_blank%22%3E%3Cspan+style%3D%22color%3Argb%28128%2C0%2C128%29%3B%22%3Ehttp%3A%2F%2Fwww.xe.com%2F%3C%2Fspan%3E%3C%2Fa%3E%3C%2Fspan%3E%3Cspan+style%3D%22color%3Argb%28128%2C0%2C128%29%3B%22%3E%26nbsp%3B%3C%2Fspan%3E%3C%2Fspan%3E%3C%2Fp%3E%0D%0A%0D%0A%3Cp+style%3D%22margin%3A0px+0px+10px%3B%22%3E%3Cspan+style%3D%22color%3Argb%28255%2C0%2C0%29%3B%22%3E%3Cspan+style%3D%22font-size%3A20px%3B%22%3E%3Cspan+style%3D%22font-weight%3A700%3B%22%3EAll+lots+are+100%25+guaranteed.+Money+refunded+unless+negative+feed+back+is+left+before+I+have+a+chance+to+make+it+right%3C%2Fspan%3E%3C%2Fspan%3E%3C%2Fspan%3E%3Cspan+style%3D%22color%3Argb%28128%2C0%2C128%29%3B%22%3E%3Cspan+style%3D%22font-size%3A20px%3B%22%3E%3Cspan+style%3D%22font-weight%3A700%3B%22%3E.%3C%2Fspan%3E%26nbsp%3B%3C%2Fspan%3E%3C%2Fspan%3E%3C%2Fp%3E%0D%0A%0D%0A%3Cp+style%3D%22margin%3A0px+0px+10px%3B%22%3E%3Cspan+style%3D%22color%3Argb%280%2C0%2C205%29%3B%22%3E%3Cspan+style%3D%22font-size%3A20px%3B%22%3E%3Cspan+style%3D%22font-weight%3A700%3B%22%3EChecks+Accepted+only+on+US+Banks%3C%2Fspan%3E%3C%2Fspan%3E%3C%2Fspan%3E%3C%2Fp%3E%0D%0A%0D%0A%3Cp+style%3D%22margin%3A0px+0px+10px%3B%22%3E%3Cspan+style%3D%22font-size%3A36px%3B%22%3E%3Cspan+style%3D%22font-weight%3A700%3B%22%3E%3Cspan+style%3D%22color%3Argb%28255%2C0%2C0%29%3B%22%3ECheck+Out+All+German+Stamps+at%3C%2Fspan%3E%26nbsp%3B*****%26nbsp%3BGerman+Lists%26nbsp%3B%3C%2Fspan%3E%3C%2Fspan%3E%3Cspan+style%3D%22font-size%3A22px%3B%22%3E%3Cspan+style%3D%22font-weight%3A700%3B%22%3E%3Ca+href%3D%22http%3A%2F%2F*****.com%2FGermanlists.htm%22+rel%3D%22nofollow+noreferrer+noopener%22+style%3D%22background-color%3Atransparent%3Bcolor%3Argb%2851%2C122%2C183%29%3Btext-decoration%3Anone%3B%22+target%3D%22_blank%22%3Ehttp%3A%2F%2F*****.com%2FGermanlists.htm%3C%2Fa%3E%3C%2Fspan%3E%3C%2Fspan%3E%3C%2Fp%3E%0D%0A%0D%0A%3Cp+style%3D%22margin%3A0px+0px+10px%3B%22%3E%3Cspan+style%3D%22font-size%3A36px%3B%22%3E%3Cspan+style%3D%22font-weight%3A700%3B%22%3EStamps+are+listed+in+******+Catalog+numbers.%3C%2Fspan%3E%3C%2Fspan%3E%3C%2Fp%3E%0D%0A%0D%0A%3Cp+style%3D%22margin%3A0px+0px+10px%3B%22%3E%3Cspan+style%3D%22color%3Argb%28255%2C0%2C0%29%3B%22%3E%3Cspan+style%3D%22font-size%3A36px%3B%22%3E%3Cspan+style%3D%22font-weight%3A700%3B%22%3ETo+complete+this+order+Please+contact%3C%2Fspan%3E%3C%2Fspan%3E%3C%2Fspan%3E%3Cspan+style%3D%22font-size%3A36px%3B%22%3E%3Cspan+style%3D%22font-weight%3A700%3B%22%3E%26nbsp%3B******%40centurylink.net%3C%2Fspan%3E%3C%2Fspan%3E%3C%2Fp%3E%0D%0A%3C%2Fdiv%3E%0D%0A&condition=2&brand=&upc=&mpn=&220213=&220214=&220215=&220216=&220217=&220218=&220219=&220220=&220221=&220222=&220223=&220225=&220227=&itemaspects=%7B%7D&reserveprice=0&listingtype=2&binprice=1.5&quantity=1&duration=99&service1=15&servicecost1=0.60&addcost1=0.00


---LoANlvlP---H--
ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:\$(?:\((?:\(.*\)|.*)\)|\{.*})|[<>]\(.*\))' against variable `ARGS:description' (Value: `<p><span style="font-size:28px;"><span style="color:rgb(255,0,0);"><strong>Germany Scott #B138 Used< (4059 characters omitted)' ) [file "/etc/nginx/modsec/coreruleset-4.0.0-rc1/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "334"] [id "932130"] [rev ""] [msg "Remote Command Execution: Unix Shell Expression Found"] [data "Matched Data: >(.60 charge if under $10.00)</span><span style=color:rgb(0 0 128) ><span style=font-size:20px >&nbsp </span></span></p> </div> <p style=margin:0px 0px 10px ><span style=font-size:20px > (5609 characters omitted)"] [severity "2"] [ver "OWASP_CRS/4.0.0-rc1"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "***.***.***.***"] [uri "/sell/step3.php"] [unique_id "166811183185.848525"] [ref "o1670,1933v1501,3997t:cmdLine"]
ModSecurity: Warning. detected XSS using libinjection. [file "/etc/nginx/modsec/coreruleset-4.0.0-rc1/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "38"] [id "941100"] [rev ""] [msg "XSS Attack Detected via libinjection"] [data "Matched Data: XSS data found within ARGS:description: <p><span style="font-size:28px;"><span style="color:rgb(255,0,0);"><strong>Germany Scott #B138 Used</strong>\xa0</span></span></p>\x0d\x0a\x0d\x0a<p><span style= (3796 characters omitted)"] [severity "2"] [ver "OWASP_CRS/4.0.0-rc1"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "***.***.***.***"] [uri "/sell/step3.php"] [unique_id "166811183185.848525"] [ref "v1501,3997t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:(?:<\w[\s\S]*[\s/]|['\"](?:[\s\S]*[\s/])?)(?:on(?:d(?:e(?:vice(?:(?:orienta|mo)tion|proximity|found|light)|livery(?:success|error)|activate)|r(?:ag(?:e(?:n(?:ter|d)|xit)|(?:gestur|leav)e|start| (3147 characters omitted)' against variable `ARGS:description' (Value: `<p><span style="font-size:28px;"><span style="color:rgb(255,0,0);"><strong>Germany Scott #B138 Used< (4059 characters omitted)' ) [file "/etc/nginx/modsec/coreruleset-4.0.0-rc1/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "156"] [id "941160"] [rev ""] [msg "NoScript XSS InjectionChecker: HTML Injection"] [data "Matched Data: <p><span style="font-size:28px;"><span style="color:rgb(255,0,0);"><strong>Germany Scott #B138 Used</strong>\xa0</span></span></p>\x0d\x0a\x0d\x0a<p><span style="font-size:22px;"><span style="color:#00 (7661 characters omitted)"] [severity "2"] [ver "OWASP_CRS/4.0.0-rc1"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "***.***.***.***"] [uri "/sell/step3.php"] [unique_id "166811183185.848525"] [ref "o0,3873v1501,3997t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
ModSecurity: Warning. Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/coreruleset-4.0.0-rc1/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0-rc1"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "***.***.***.***"] [uri "/sell/step3.php"] [unique_id "166811183185.848525"] [ref ""]

How should I deal with this situation or how to craft the custom rule for this page? I'd like to protect all the pages in general, but I need a special exclusion of some kind for users submitting HTML formatting in their item description.

Thanks!

2 Answers 2

2

CRS Dev-On-Duty here. In general, you have multiple possibilities to deal with false positives. The following tutorials and cheat sheet by our co-lead Christian Folini help a lot: https://www.netnea.com/cms/apache-tutorials/

If you want to add a very specific tuning, I would suggest a rule similar to this:

SecRule REQUEST_FILENAME "@streq /sell/step3.php" \
"id:1001,\
phase:1,\
pass,\
nolog,\
ctl:ruleRemoveTargetById=932130;ARGS:description,\
ctl:ruleRemoveTargetById=941100;ARGS:description,\
ctl:ruleRemoveTargetById=941160;ARGS:description"
0

If you allow users to enter HTML and embed it later on in the DOM, you allow XSS. Either you prohibit HTML input and eliminate this XSS risk. Or you allow it and accept security risks related to XSS.

What can you do instead? For instance, you can provide some editor, where users can define the formatting they need. Based on this you will generate HTML, CSS, JavaScript on the server side in a controlled way.

1
  • We will have to accept security risks related to XSS (for now). We have an HTML/DOM sanitizer + script tab stripper in the background, which has done a pretty good job for years, although it's not perfect. However, I still need a rule crafted for ModSecurity to make exceptions for these on the page in question when a user submits their product. In the $_POST variable, is ModSecurity able to ignore one of the parameters, such as the "item description" parameter where the HTML would likely be found? I'd prefer not completely turning off ModSecurity on that page though. (Added versions to OP.)
    – peppy
    Commented Nov 11, 2022 at 20:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .