Increasing critical_anomaly_score does not block request

Question

I am using CRS 4.3.0

I am modify the default crs-setup.conf to increase the anomali_score for critical triggered rules :

    "id:900100,\
    phase:1,\
    pass,\
    t:none,\
    nolog,\
    tag:'OWASP_CRS',\
    ver:'OWASP_CRS/4.3.0',\
    setvar:tx.critical_anomaly_score=7,\
    setvar:tx.error_anomaly_score=4,\
    setvar:tx.warning_anomaly_score=3,\
    setvar:tx.notice_anomaly_score=2"

What I want to achieve is, each time any critical event triggered, it incrementally add as 7 will get blocked by the modsecurity. Default inbound_anomaly_score_threshold=5

Apparently, when I tested to trigger it using : curl 'https://example.com/.bash_'

And it trigger as in log :

ModSecurity: Warning. Matched "Operator PmFromFile' with parameter restricted-files.data' against variable REQUEST_FILENAME' (Value: /.bash_' ) [file "/etc/apache2/modsecurity.d/owasp-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "124"] [id "930130"] [rev ""] [msg "Restricted File Access Attempt"] [data "Matched Data: .bash_ found within REQUEST_FILENAME: /.bash_"] [severity "2"] [ver "OWASP_CRS/4.3.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "example.com"] [uri "/.bash_"] [unique_id "171893186374.358779"] [ref "o1,6v4,7t:utf8toUnicode,t:urlDecodeUni,t:normalizePathWin"]

It does not block as expected.

Any guidance will be appreciated

Answer 1

This was resolved on CRS github page and problem was with some custom modifications to CRS done by a user.