Cannot allow 920600 in crs

Question

I have these rules :

SecRule REQUEST_URI "@rx ^/(.*)$" \
    "id:94000001,phase:1,t:none,nolog,pass,\
    ctl:ruleRemoveById=933120,\
    ctl:ruleRemoveById=933150,\
    ctl:ruleRemoveById=920210,\
    ctl:ruleRemoveById=931100,\
    ctl:ruleRemoveById=920600,\
    ver:'wordpress-exception/1'"

To allow this request to be accepted by server but, it always get blocked by the rules of 920600

Here is the request :

curl -H "Accept: text/htmlapplication/xhtml+xmlapplication/xml;q=0.9*/*q=0.8" "http://example.com/abc

Spesification : Apache2 CRS Version : 4.3.0

I would appreciate any suggestion.

Answer 1

CRS dev-on-duty here. Thank you for providing the logs. As you have already spotted, you have a problem with OWASP CRS rule 920600 that checks for Illegal Accept header: charset parameter.

Your Accept header in your curl request seems to be broken. It seems that white spaces, , and ; are missing.

This is your Accept header: text/htmlapplication/xhtml+xmlapplication/xml;q=0.9*/*q=0.8

And this is a valid Accept header: text/html, application/xhtml+xml, application/xml;q=0.9, */*;q=0.8

Where does your Accept header come from? It's better to fix this Accept header than disabling the rule.

But if you still need to disable this rule, you can do so by adding the following directive AFTER including the OWASP CRS rules (rules/*.conf): SecRuleRemoveById 920600.

In case you need further guidance on how to tune your OWASP CRS rules, please have a look at our documentation: https://coreruleset.org/docs/concepts/false_positives_tuning/