1

Issue

I have try to inject XSS in an input and the log total of anomaly score is 84 (enough to block the request) The action return Access denied but why it return 200 code and the action is allowed to be passed to the webserver.

Specification :

Apache 2.4.41 CRS-Rules : 4.3.0 (default setting intact) Modsec version : 3 latest

How it get triggered :

Adding in input using XSS with code <img src=a onerror=alert('dsklajl')>

Complete Log Audit Log :

ModSecurity: Warning. detected XSS using libinjection. [file "/etc/apache2/modsecurity.d/owasp-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "82"] [id "941100"] [rev ""] [msg "XSS Attack Detected via libinjection"] [data "Matched Data: XSS data found within ARGS:givenName[ar]: <img src=a onerror=alert('42232dsklajl')>"] [severity "2"] [ver "OWASP_CRS/4.3.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "xss-perf-disable"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "example.com"] [uri "/jcb/api/v1/submissions/140/publications/143/contributors/187"] [unique_id "172023569217.942580"] [ref "v3538,36t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNullsv3443,36t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNullsv3682,818t:u (177 characters omitted)"]
ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)<[^0-9<>A-Z_a-z]*(?:[^\s\x0b\"'<>]*:)?[^0-9<>A-Z_a-z]*[^0-9A-Z_a-z]*?(?:s[^0-9A-Z_a-z]*?(?:c[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?p[^0-9A-Z_a-z]*?t|t[^0-9A-Z_a-z]*?y[^0-9A-Z_a-z]*?l[^0-9A (4341 characters omitted)' against variable `ARGS:givenName[ar]' (Value: `<img src=a onerror=alert('42232dsklajl')>' ) [file "/etc/apache2/modsecurity.d/owasp-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "200"] [id "941160"] [rev ""] [msg "NoScript XSS InjectionChecker: HTML Injection"] [data "Matched Data: <img  found within ARGS:givenName[ar]: <img src=a onerror=alert('42232dsklajl')>"] [severity "2"] [ver "OWASP_CRS/4.3.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "xss-perf-disable"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "example.com"] [uri "/jcb/api/v1/submissions/140/publications/143/contributors/187"] [unique_id "172023569217.942580"] [ref "o0,5v3538,36t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNullso0,5v3443,36t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNullso0,7 (195 characters omitted)"]
ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)\b(?:eval|set(?:timeout|interval)|new[\s\x0b]+Function|a(?:lert|tob)|btoa|prompt|confirm)[\s\x0b]*\(' against variable `ARGS:givenName[ar]' (Value: `<img src=a onerror=alert('42232dsklajl')>' ) [file "/etc/apache2/modsecurity.d/owasp-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "713"] [id "941390"] [rev ""] [msg "Javascript method detected"] [data "Matched Data: alert( found within ARGS:givenName[ar]: <img src=a onerror=alert('42232dsklajl')>"] [severity "2"] [ver "OWASP_CRS/4.3.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "attack-xss"] [tag "xss-perf-disable"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "example.com"] [uri "/jcb/api/v1/submissions/140/publications/143/contributors/187"] [unique_id "172023569217.942580"] [ref "o19,6v3538,36t:htmlEntityDecode,t:jsDecodeo19,6v3443,36t:htmlEntityDecode,t:jsDecodeo763,6v3682,818t:htmlEntityDecode,t:jsDecodeo19,6v3349,41t:htmlEntityDecode,t:jsDecode"]
ModSecurity: Access denied with code 200 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `84' ) [file "/etc/apache2/modsecurity.d/owasp-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "222"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 84)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.3.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "example.com"] [uri "/jcb/api/v1/submissions/140/publications/143/contributors/187"] [unique_id "172023569217.942580"] [ref ""]

My action : I have also try to change the crs-setup.conf line 97-98 to SecDefaultAction "phase:X,log,auditlog,deny" and get same result

Expected result

It should get block because in anomaly score it reach more than 7. But it weirdly response 200 code and data along with XSS should not be processed by the webserver.

Any guidance is appreciated.

Regards

5
  • This issues probably related to how ModSec handles the HTTP response codes when blocking requests. Commented Jul 6 at 3:52
  • Sure you are not running with DetectionOnly? Commented Jul 6 at 4:32
  • The SecRuleEngine is On, no change on that.
    – navotera
    Commented Jul 6 at 6:24
  • "Apache 2.4.41 CRS-Rules : 4.3.0 (default setting intact) Modsec version : 3 latest" - do you REALLY use libmodsecurity3 with Apache connector for Apache2 webserver? If yes, that IS the problem. The Apache connector is completely broken, please don't use that. See the notification: github.com/owasp-modsecurity/….
    – airween
    Commented Jul 6 at 8:20
  • it is sad to know that thank you @airween
    – navotera
    Commented Jul 6 at 8:41

0

You must log in to answer this question.

Browse other questions tagged .