0

I am using CRS 4.3.0

I try to test is it active :

curl 'https://example.com/?foo=/etc/passwd&bar=/bin/sh'
curl : The remote server returned an error: (403) Forbidden.

However when using other approach by requesting this url : curl 'https://example.com/.bash_'

ModSecurity only show log :

ModSecurity: Warning. Matched "Operator PmFromFile' with parameter restricted-files.data' against variable REQUEST_FILENAME' (Value: /.bash_' ) [file "/etc/apache2/modsecurity.d/owasp-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "124"] [id "930130"] [rev ""] [msg "Restricted File Access Attempt"] [data "Matched Data: .bash_ found within REQUEST_FILENAME: /.bash_"] [severity "2"] [ver "OWASP_CRS/4.3.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "example.com"] [uri "/.bash_"] [unique_id "171876508270.997608"] [ref "o1,6v4,7t ,t ,t "]

SecRuleEngine On apache version : Apache/2.4.41

Content of init.conf :

   Include "/etc/apache2/modsecurity.d/modsecurity.conf"
   #Include "/etc/apache2/modsecurity.d/owasp-crs/crs-setup.conf"
   #Include "/etc/apache2/modsecurity.d/owasp-crs/rules/*.conf"

    Include /etc/apache2/modsecurity.d/owasp-crs/crs-setup.conf 
    Include /etc/apache2/modsecurity.d/owasp-crs/plugins/*-config.conf
    Include /etc/apache2/modsecurity.d/owasp-crs/plugins/*-before.conf 
    Include /etc/apache2/modsecurity.d/owasp-crs/rules/*.conf 
    Include /etc/apache2/modsecurity.d/owasp-crs/plugins/*-after.conf 

After more digging, I found that the threshold for one rules still not reaching the accumulated threshold as default is 7 anomaly score.

Based on this reference : https://github.com/SpiderLabs/OWASP-CRS-Documentation/blob/master/anomaly.rst I have configured this in crs-setup.conf :

 "id:'900003',\
  phase:1,\
  nolog,\
  pass,\
  t:none,\
  setvar:tx.sql_injection_score_threshold=15,\
  setvar:tx.xss_score_threshold=15,\
  setvar:tx.rfi_score_threshold=1,\
  setvar:tx.lfi_score_threshold=1,\
  setvar:tx.rce_score_threshold=1,\
  setvar:tx.command_injection_score_threshold=5,\
  setvar:tx.php_injection_score_threshold=5,\
  setvar:tx.http_violation_score_threshold=5,\
  setvar:tx.trojan_score_threshold=5,\
  setvar:tx.session_fixation_score_threshold=5,\
  setvar:tx.inbound_anomaly_score_threshold=5,\
  setvar:tx.outbound_anomaly_score_threshold=4"

Take attention to this :

  setvar:tx.lfi_score_threshold=1,\
  setvar:tx.rce_score_threshold=1,\

But after try again this : curl 'https://example.com/.bash_' It only warning not blocking although logically it has reach the threshold.

Please any guidance ?

2 Answers 2

1

You have misconfigured your CRS installation. Also, the link to the documentation you are refering to is very old and even points to the old, unused github account and repository. The current CRS repository is here and newest documentation here.

The default anomaly threshold is 5, not 7, so this is something you have set in crs-setup.conf file. You can change it using rule 900110. Looks like you are using crs-setup from some very old CRS verion.

3
  • 1
    "You have misconfigured your CRS installation." -- you'll need to explain the problem rather than merely asserting that there is a problem.
    – schroeder
    Commented Jun 19 at 18:55
  • Do you mean that this setvar:tx.lfi_score_threshold=1,\ setvar:tx.rce_score_threshold=1,\ is no longer valid ? Can the anomaly scoring threshold modified based on the type of attach such as sqli, lfi, rfi ?
    – navotera
    Commented Jun 19 at 23:50
  • Yes, these settings no longer exists in currect version of CRS (maybe they were valid in the past, not sure). The only thresholds you can set are in config rule 900110.
    – azurit
    Commented Jun 20 at 7:30
1

Having only the names of the config files instead of their actual content is only barely useful, since one can only guess what the content of the config might be.

Check SecDefaultAction in your crs-setup.conf and make sure it actually is set to deny and not only log (which is usually the default), i.e. something like this

SecDefaultAction "phase:1,log,auditlog,deny,status:403"
1
  • Thank you for your helpful comment. It seems like this is using the 'Traditional approach' rather than the anomaly threshold approach. I have update my question, I hope you can help.
    – navotera
    Commented Jun 19 at 8:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .