Questions tagged [owasp-crs]
The owasp-crs tag has no usage guidance.
19
questions
4
votes
2
answers
693
views
Why is PUT Request not allowed by default in OWASP CoreRuleSet
Why is PUT method not allowed and how can I allow PUT methods without changing REQUEST-901-INITIALIZATION.conf file and REQUEST-911-METHOD-ENFORCEMENT.conf file.
- 49
0
votes
1
answer
46
views
Modsecurity parse nested keys in json
I am writing an exception rule. I have the JSON:
{"pageNumber":0,"pageSize":100,"sorts":[{"field":"hex","direction":"ASC"}],"...
- 1
3
votes
1
answer
250
views
OWASP CRS - Is "%00" in request form body is false positive?
We have a HTTP POST endpoint for a web form and when sending a request the request has Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryLOAPHJhA1BQSTatn set.
When the payload contains ...
- 135
1
vote
0
answers
55
views
Modsecurity CRS access denied with response 200?
Issue
I have try to inject XSS in an input and the log total of anomaly score is 84 (enough to block the request)
The action return Access denied but why it return 200 code and the action is allowed ...
- 149
2
votes
1
answer
339
views
Why Owasp-crs does not allow Content-Type: application/x-www-form-urlencoded
I try to craft a http post using this curl :
curl -v -X POST "http://example.com/submit.php" -H "Content-Type: application/x-www-form-urlencoded;" --data "email=test@example....
- 149
0
votes
1
answer
72
views
Cannot allow 920600 in crs
I have these rules :
SecRule REQUEST_URI "@rx ^/(.*)$" \
"id:94000001,phase:1,t:none,nolog,pass,\
ctl:ruleRemoveById=933120,\
ctl:ruleRemoveById=933150,\
ctl:...
- 149
1
vote
1
answer
34
views
Increasing critical_anomaly_score does not block request
I am using CRS 4.3.0
I am modify the default crs-setup.conf to increase the anomali_score for critical triggered rules :
"id:900100,\
phase:1,\
pass,\
t:none,\
nolog,\
tag:...
- 149
0
votes
1
answer
137
views
How do I unblock a request uri in Modsecurity CRS?
I have installed a Nginx WAF with Modsecurity CRS. This WAF protects a backend WordPress.
One request from one of the plugins generated a false positive on the Modsecurity with the rule id 933120.
I ...
- 101
0
votes
2
answers
97
views
Modsecurity only show warning but not blocking?
I am using CRS 4.3.0
I try to test is it active :
curl 'https://example.com/?foo=/etc/passwd&bar=/bin/sh'
curl : The remote server returned an error: (403) Forbidden.
However when using other ...
- 149
0
votes
0
answers
55
views
How to make the rules 920600 and 922110 dynamic to have custom charsets (custom regexp) in CRS 4 [duplicate]
There is a regexp in the rules 920600 and 922110 that (according to my opinion) accepts only 4 charsets in the Accept header. I need to make it custom, so the regexp must be modified based on my ...
user303436
1
vote
1
answer
682
views
ModSecurity CRS, allow header `accept-charset`
I have ModSecurity v2 on apache with CRS v3.
Requests containing header accept-charset are blocked on paranoia level 1, I read this great discussion about the header and that on CRS v4 will be allowed ...
- 113
0
votes
1
answer
578
views
Updating regular expressions for the rules 920600, 921421, 921422 and 922110 in CRS 3.3.4
After updating to CRS 3.3.4, I want to update the regular expression of the rules 920600, 921421, 921422 and 922110. but the command util/regexp-assemble/regexp-assemble.py update 920600 does not work....
1
vote
1
answer
173
views
owasp crs 3.0 rule functuonalityconsult
I have built a waf and using CRS 3.0, this waf can inspect the request body to limit the file size that upload to the server, I am wondering ,if I just disable this feature manually, it will cause any ...
- 11
0
votes
1
answer
1k
views
ModSecurity OWASP CRS 3.3.0 false positives on a Wordpress site
The following search queries are blocked by ModSecurity and returns a 403 forbidden error:
www.example.com/s=zip+someword &
www.example.com/s=gzip+someword
but not
www.example.com/s=zip & www....
1
vote
1
answer
375
views
Modsecurity CRS how to deal with field arrays
I have a question how to deal with whitelisting field arrays in modsecurity. Currently am doing the following:
... ctl:ruleRemoveTargetById=942510;ARGS:_owc_pdc_faq_group[0][pdc_faq_answer]"
... ...
- 11
1
vote
1
answer
1k
views
OWASP CRS Anomaly scoring, ModSecurity WAF
I'm getting into OWASP CRS with ModSecurity and was investigating the way OWASP calculate the anomaly score in the REQUEST-901-INITIALIZATION.conf they set the following lines:
setvar:'tx....
- 11
1
vote
1
answer
459
views
Modsecurity - OWASP CRS 901001
Ubuntu 18.04
Apache/2.4.29
ModSecurity for Apache/2.9.2 (http://www.modsecurity.org/); OWASP_CRS/3.0.0
modsecurity-crs 3.0.2-1
This is a new server. The following message appears in modsec_audit.log ...
- 379
1
vote
0
answers
501
views
Which OWASP modsecurity crs version to install on apache 2.2.22
Hello I am considering installing owasp mod_security crs on an ubuntu 12.04.4 which comes with apache 2.2.22. On the github page I have seen many version's but all tutorials were using 2.2.7
First I ...
- 233
0
votes
1
answer
936
views
Mod_security rules-updater.pl fails to pull new release
Mod_security has a rules updater distributed with their release packages on sourceforge:
http://sourceforge.net/projects/mod-security/files/modsecurity-crs/0-CURRENT/
Usually, you can run the script ...
- 101