Questions tagged [mod-security]
ModSecurity is a web application firewall for Apache, IIS ang Nginx. It provides logging, monitoring and filtering features.
108
questions
4
votes
2
answers
691
views
Why is PUT Request not allowed by default in OWASP CoreRuleSet
Why is PUT method not allowed and how can I allow PUT methods without changing REQUEST-901-INITIALIZATION.conf file and REQUEST-911-METHOD-ENFORCEMENT.conf file.
- 49
0
votes
1
answer
46
views
Modsecurity parse nested keys in json
I am writing an exception rule. I have the JSON:
{"pageNumber":0,"pageSize":100,"sorts":[{"field":"hex","direction":"ASC"}],"...
- 1
2
votes
1
answer
33
views
ModSecurity Condition Based Block Mode?
I'm playing with ModSecurity and need help. I'm trying to add a condition in the conf file where if there is specific header in the request then the SecRuleEngine should be On else it should be ...
3
votes
1
answer
249
views
OWASP CRS - Is "%00" in request form body is false positive?
We have a HTTP POST endpoint for a web form and when sending a request the request has Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryLOAPHJhA1BQSTatn set.
When the payload contains ...
- 135
1
vote
0
answers
55
views
Modsecurity CRS access denied with response 200?
Issue
I have try to inject XSS in an input and the log total of anomaly score is 84 (enough to block the request)
The action return Access denied but why it return 200 code and the action is allowed ...
- 149
0
votes
1
answer
72
views
Cannot allow 920600 in crs
I have these rules :
SecRule REQUEST_URI "@rx ^/(.*)$" \
"id:94000001,phase:1,t:none,nolog,pass,\
ctl:ruleRemoveById=933120,\
ctl:ruleRemoveById=933150,\
ctl:...
- 149
1
vote
1
answer
34
views
Increasing critical_anomaly_score does not block request
I am using CRS 4.3.0
I am modify the default crs-setup.conf to increase the anomali_score for critical triggered rules :
"id:900100,\
phase:1,\
pass,\
t:none,\
nolog,\
tag:...
- 149
0
votes
1
answer
136
views
How do I unblock a request uri in Modsecurity CRS?
I have installed a Nginx WAF with Modsecurity CRS. This WAF protects a backend WordPress.
One request from one of the plugins generated a false positive on the Modsecurity with the rule id 933120.
I ...
- 101
0
votes
2
answers
94
views
Modsecurity only show warning but not blocking?
I am using CRS 4.3.0
I try to test is it active :
curl 'https://example.com/?foo=/etc/passwd&bar=/bin/sh'
curl : The remote server returned an error: (403) Forbidden.
However when using other ...
- 149
1
vote
0
answers
83
views
How to include the coreruleset rules in OPNsense firewall WAF (Nginx)
I want to integrate ModSecurity into the WAF to ensure I'm protected with OWASP Top 10 security mitigations. I'd appreciate your guidance if there are any specific configurations you recommend for ...
1
vote
0
answers
591
views
How to set requests rate limit using Mod Security Rule?
I tried to find a way to limit requests per minute (or other time) using mod security rule in apache, but didn't get success from anywhere.
I think it needs more expertise to write such complex rules ...
2
votes
1
answer
355
views
Modsecurity blocks blocks my legit XHR POST request (403 forbidden)
I'm new to modsecurity topic so maybe my question is stupid but...
I have setup modsecurity on my new nginx/1.24.0 server with default set of recommended rules: coreruleset-3.3.0 and since then my ...
- 121
0
votes
0
answers
55
views
How to make the rules 920600 and 922110 dynamic to have custom charsets (custom regexp) in CRS 4 [duplicate]
There is a regexp in the rules 920600 and 922110 that (according to my opinion) accepts only 4 charsets in the Accept header. I need to make it custom, so the regexp must be modified based on my ...
user303436
1
vote
1
answer
680
views
ModSecurity CRS, allow header `accept-charset`
I have ModSecurity v2 on apache with CRS v3.
Requests containing header accept-charset are blocked on paranoia level 1, I read this great discussion about the header and that on CRS v4 will be allowed ...
- 113
0
votes
2
answers
644
views
What is Method Enforcement. How to simulate this attack?
I need to know what is "method enforcement" inside WAF Preconfigured ModSecurity rules.
How to test this attack on magento website? What is security best practice to prevent this?
0
votes
0
answers
267
views
ModSecurity: How to disable error logging for single rule?
Here is my configurations:
SecDefaultAction "phase:1,log,deny,status:403"
SecDefaultAction "phase:2,log,deny,status:403"
SecRule REQUEST_URI "@pm logging_test" \
&...
- 1
0
votes
1
answer
458
views
Compatibility of ModSecurity Core Rule Set 4
OWASP Core Rule Set has many versions the latest is version 4.0 (release candidate), but I cannot find any indication about compatibility among various modsecurity releases.
Could these be used with ...
- 103
0
votes
1
answer
578
views
Updating regular expressions for the rules 920600, 921421, 921422 and 922110 in CRS 3.3.4
After updating to CRS 3.3.4, I want to update the regular expression of the rules 920600, 921421, 921422 and 922110. but the command util/regexp-assemble/regexp-assemble.py update 920600 does not work....
5
votes
2
answers
7k
views
ModSecurity: How to increase SecRequestBodyLimit for specific website REQUEST_URI?
I received this error in my ModSecurity logs:
ModSecurity: Warning. Matched "Operator `Eq' with parameter `0' against variable `REQBODY_ERROR' (Value: `1' ) [file "/etc/nginx/modsec/...
- 111
7
votes
1
answer
1k
views
How do I interpret the "stopwatch" lines in modsecurity logs?
My modsecurity log produces lines like this in section H:
Stopwatch: 1672766910416996 75370993 (- - -)
Stopwatch2: 1672766910416996 75370993; combined=8155, p1=1356, p2=5617, p3=149, p4=895, p5=137, ...
2
votes
1
answer
983
views
ModSecurity: How to whitelist specific cookie name?
I have a false positive involving the content of one of my cookies:
ModSecurity: Warning. Matched "Operator `PmFromFile' with parameter `lfi-os-files.data' against variable `REQUEST_COOKIES:xid' (...
- 111
2
votes
1
answer
1k
views
ModSecurity: How to disable logging for specific REQUEST_URI?
I have a specific URL that keeps getting checked by weird bots, and that keeps triggering ModSecurity rules that fill up my logs. I would like to disable logging for that one specific URL to make it ...
- 111
0
votes
1
answer
2k
views
ModSecurity: How to write exclusion rules for list of REQUEST_URIs on separate domain names?
I have a server with 100 domain names. On each domain name, I have a unique list of pages/directories that I would like to whitelist (put ModSecurity into DetectionOnly mode temporarily). Basically, ...
- 111
1
vote
2
answers
718
views
ModSecurity / CRS: Need custom rule to deal with false positive (user-inserted HTML formatted listings)
ModSecurity 3.0.8
ModSecurity-Nginx 1.0.3
CRS 4.0.0-rc1
I have a marketplace where sellers can list anything for sale. On the "item description" section, we allow users to copy and paste ...
- 111
0
votes
2
answers
2k
views
Execution error - PCRE limits exceeded
I have problem when implementing modsecurity and crs. Here is the issue, I hope anyone can give us some guide for resolving this issue.
Apache version :
Server version: Apache/2.4.29 (Ubuntu) Server ...
- 149
1
vote
1
answer
306
views
text/plain removed from list Content-Types default
in the CRS v3.3.3 update, some Content-Types allowed in rule 900220 were removed and explanatory comment added, but it generated a doubt when I saw that text/plain was removed from this list.
Why not ...
- 51
0
votes
0
answers
269
views
Very slow SOAP POST request processing with ModSecure for certain rules (SQL, IIS and system exploits)
While trying to implement NGinx WAF with ModSecurity 3.0.6 I am facing the issue with very poor XML SOAP POST performance. Rrequests takes ~5 seconds with occasional spikes up to 10 seconds.
If I ...
- 1
2
votes
2
answers
1k
views
ModSecurity: Block all IPs except for a list of defined IPs
I have an apache server with ModSecurity. I need to block all IPs except for a few ones.
The list of IPs is like this:
194.83.128.0/21
191.143.32.0/19
145.126.72.0/21
101.28.248.0/22
40.64.64.0/22
180....
- 121
0
votes
1
answer
651
views
ModSec Head Scratcher - Rule Exceptions ignored
Sorry if this is a "noob" mistake, which I am sure it is, but I can't figure out why ModSec is ignoring my rule exception.
Situation (Debian 10): I have a ssl secured url for Monit ...
- 61
0
votes
1
answer
1k
views
ModSecurity rule 941160 triggered by WordPress legacy-widget-preview
We have an issue with ModSecurity rule 941160 being triggered by the WordPress feature legacy-widget-preview because the request to upload an image file into the widget matches "<img src="...
- 13
0
votes
1
answer
423
views
Why is my SecAction rule being ignored?
I'm trying to configure a
SecAction rule to help me tune ModSecurity 3 following this How to tune your WAF installation to reduce false positives tutorial, but the rule seems to be ignored and the msg ...
- 51
1
vote
1
answer
803
views
ModSecurity rule 932150 false positive, remove ruby from criteria
We have an issue with ModSecurity rule 932150 being triggered when someone searches a site for "ruby red", because (I presume) the rule thinks it's blocking potential Ruby on Rails code.
I ...
- 13
0
votes
1
answer
1k
views
ModSecurity OWASP CRS 3.3.0 false positives on a Wordpress site
The following search queries are blocked by ModSecurity and returns a 403 forbidden error:
www.example.com/s=zip+someword &
www.example.com/s=gzip+someword
but not
www.example.com/s=zip & www....
0
votes
1
answer
246
views
Suspicious visits to one URL from same user-agent but from unique IPs
For the past few weeks, I am observing a lots of visits from a specific user-agent - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36 ...
- 107
1
vote
0
answers
340
views
regexp of a modsec rule
Is there a place I can view modsec rules?
Trying to save some javascipt & html code through elementor on wordpress triggered some modsec rule. Specifically:
[file "/etc/apache2/conf.d/modsec/...
- 625
3
votes
1
answer
802
views
ModSecurity - XSS not blocked when #/ (hash) is added in the url by NodeJS application
I have installed ModSecurity in Apache server and using it as a reverse proxy to forward request to a NodeJS applicaiton.
I have followed this tutorial to configure ModSecurity in Apache, https://www....
- 31
2
votes
1
answer
476
views
Can modsecurity 2.x read data from a text file that has been updated?
I'm writing a rule for modsecurity 2.x to match an IP address to those in a file.
SecRule REMOTE_ADDR "@ipMatchFromFile /etc/modsecurity/address_list.txt"
I understand how this works, I'm ...
- 123
2
votes
0
answers
456
views
Mod-security and WordPress WAF
On my WordPress websites (on LEMP stack with Nginx) I normally install a WAF plugin such as Ninja Firewall or Wordfence.
I was wondering if a better practice would be to replace them with a host-based ...
- 151
1
vote
2
answers
263
views
ModSecurity Command Injection not working
I am testing web application firewall and I have installed ModSecurity 2.9 runs Core ModSecurity Rule Set ver.2.2.9 and to test on Web application I also install DVWA Platform: Windows
and trying ...
- 11
1
vote
1
answer
928
views
How to exclude rule 930120 for google oauth
I've this error:
ModSecurity: Warning. Matched "Operator `PmFromFile' with parameter `lfi-os-files.data' against variable `ARGS:scope' (Value: `email profile https://www.googleapis.com/auth/...
- 115
1
vote
1
answer
529
views
Is `SecAction` order important for an OWASP ModSecurity config file?
Using a web server with Nginx + ModSecurity + OWASP ModSecurity Core Rules...
On the OWASP config file crs-setup.conf is the order of the config section SecAction important or can i order them ...
- 111
1
vote
1
answer
1k
views
OWASP CRS Anomaly scoring, ModSecurity WAF
I'm getting into OWASP CRS with ModSecurity and was investigating the way OWASP calculate the anomaly score in the REQUEST-901-INITIALIZATION.conf they set the following lines:
setvar:'tx....
- 11
0
votes
1
answer
382
views
For certain URI, is it possible to log the rule violation instead of returning access deny?
We have set up Modsecurity CRS with Nginx and we are in the phase of customization (or writing the exclusion rules).
We'd like to know if it is possible that modsec can only log the exception for ...
- 115
0
votes
1
answer
403
views
How apache tomcat favicon can be malicious or cause unintended results in application?
At the moment, there aren't any of those vulnerabilities that we know. I was looking the docs on what damages can be done by hackers if apache tomcat favicon is revealed in web application.
- 101
0
votes
1
answer
269
views
How to block for open Web Shell in my CentOS 6
I currently use mod_security in combination with maldec and block almost all attempts to upload shells, leading them to error 406. However, I found one "problem" if I upload Shell through an ftp ...
- 1
1
vote
1
answer
459
views
Modsecurity - OWASP CRS 901001
Ubuntu 18.04
Apache/2.4.29
ModSecurity for Apache/2.9.2 (http://www.modsecurity.org/); OWASP_CRS/3.0.0
modsecurity-crs 3.0.2-1
This is a new server. The following message appears in modsec_audit.log ...
- 379
2
votes
0
answers
173
views
mod_security flush persistence
I run a website with a resource & time consuming URL, say ~20 seconds per request. In the last few days this URL is being targeted by some kind of DoS attack, and I'm trying to use mod_security so ...
- 21
0
votes
1
answer
1k
views
ClamAV detects virus in Modsec Audit logs
I have a Xen VM running Debian Stretch with Apache2 to play around with. I have installed ClamAV and Modsecurity (not doing anything just logging at the moment). I keep getting emails from ClamAV ...
- 57
1
vote
1
answer
2k
views
Nginx: mod-security rule for http slow DoS attack
The only related rule in mod-security for slow DoS is modsecurity_crs_11_slow_dos_protection, and it's for Apache only.
Is there a rule for Nginx?
- 11
3
votes
3
answers
706
views
How useful is the default configuration of ModSecurity for a generic web application?
Scenario:
ModSecurity with a "default" or "generic" configuration (like the one that might be provided by shared hosting providers, for example).
Generic web application (custom, uncommon, or unknown)...
- 15.9k