Questions tagged [owasp-crs]
The owasp-crs tag has no usage guidance.
23 questions
4
votes
2
answers
880
views
Why is PUT Request not allowed by default in OWASP CoreRuleSet
Why is PUT method not allowed and how can I allow PUT methods without changing REQUEST-901-INITIALIZATION.conf file and REQUEST-911-METHOD-ENFORCEMENT.conf file.
- 91
3
votes
1
answer
316
views
OWASP CRS - Is "%00" in request form body is false positive?
We have a HTTP POST endpoint for a web form and when sending a request the request has Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryLOAPHJhA1BQSTatn set.
When the payload contains ...
- 135
2
votes
1
answer
372
views
Why Owasp-crs does not allow Content-Type: application/x-www-form-urlencoded
I try to craft a http post using this curl :
curl -v -X POST "http://example.com/submit.php" -H "Content-Type: application/x-www-form-urlencoded;" --data "email=test@example....
- 149
2
votes
1
answer
157
views
How to put specific rules in OWASP core ruleset in detection mode?
This is the content of my RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf
# Set the rules to detection mode (they will log but not block)
SecRuleUpdateActionById 941100 "pass,log"
...
- 91
2
votes
0
answers
54
views
ModSecurity is not blocking attacks in sent in raw json data
When I send this http request as an urlencoded request modsecurity is blocking the request.
But when I send the request of the Content-Type: application/json the request is not being blocked.
- 91
1
vote
1
answer
834
views
ModSecurity CRS, allow header `accept-charset`
I have ModSecurity v2 on apache with CRS v3.
Requests containing header accept-charset are blocked on paranoia level 1, I read this great discussion about the header and that on CRS v4 will be allowed ...
- 113
1
vote
1
answer
41
views
Increasing critical_anomaly_score does not block request
I am using CRS 4.3.0
I am modify the default crs-setup.conf to increase the anomali_score for critical triggered rules :
"id:900100,\
phase:1,\
pass,\
t:none,\
nolog,\
tag:...
- 149
1
vote
1
answer
182
views
owasp crs 3.0 rule functuonalityconsult
I have built a waf and using CRS 3.0, this waf can inspect the request body to limit the file size that upload to the server, I am wondering ,if I just disable this feature manually, it will cause any ...
- 11
1
vote
0
answers
72
views
Modsecurity CRS access denied with response 200?
Issue
I have try to inject XSS in an input and the log total of anomaly score is 84 (enough to block the request)
The action return Access denied but why it return 200 code and the action is allowed ...
- 149
1
vote
1
answer
406
views
Modsecurity CRS how to deal with field arrays
I have a question how to deal with whitelisting field arrays in modsecurity. Currently am doing the following:
... ctl:ruleRemoveTargetById=942510;ARGS:_owc_pdc_faq_group[0][pdc_faq_answer]"
... ...
- 11
1
vote
1
answer
1k
views
OWASP CRS Anomaly scoring, ModSecurity WAF
I'm getting into OWASP CRS with ModSecurity and was investigating the way OWASP calculate the anomaly score in the REQUEST-901-INITIALIZATION.conf they set the following lines:
setvar:'tx....
- 11
1
vote
1
answer
492
views
Modsecurity - OWASP CRS 901001
Ubuntu 18.04
Apache/2.4.29
ModSecurity for Apache/2.9.2 (http://www.modsecurity.org/); OWASP_CRS/3.0.0
modsecurity-crs 3.0.2-1
This is a new server. The following message appears in modsec_audit.log ...
- 389
1
vote
0
answers
509
views
Which OWASP modsecurity crs version to install on apache 2.2.22
Hello I am considering installing owasp mod_security crs on an ubuntu 12.04.4 which comes with apache 2.2.22. On the github page I have seen many version's but all tutorials were using 2.2.7
First I ...
- 233
0
votes
1
answer
111
views
Cannot allow 920600 in crs
I have these rules :
SecRule REQUEST_URI "@rx ^/(.*)$" \
"id:94000001,phase:1,t:none,nolog,pass,\
ctl:ruleRemoveById=933120,\
ctl:ruleRemoveById=933150,\
ctl:...
- 149
0
votes
2
answers
199
views
Modsecurity only show warning but not blocking?
I am using CRS 4.3.0
I try to test is it active :
curl 'https://example.com/?foo=/etc/passwd&bar=/bin/sh'
curl : The remote server returned an error: (403) Forbidden.
However when using other ...
- 149
0
votes
1
answer
610
views
Updating regular expressions for the rules 920600, 921421, 921422 and 922110 in CRS 3.3.4
After updating to CRS 3.3.4, I want to update the regular expression of the rules 920600, 921421, 921422 and 922110. but the command util/regexp-assemble/regexp-assemble.py update 920600 does not work....
0
votes
1
answer
939
views
Mod_security rules-updater.pl fails to pull new release
Mod_security has a rules updater distributed with their release packages on sourceforge:
http://sourceforge.net/projects/mod-security/files/modsecurity-crs/0-CURRENT/
Usually, you can run the script ...
- 101
0
votes
0
answers
23
views
How to make modsecurity log to audit_log only when the request is returning with 403 status code
I don't want logs to appear if the inboud_anomaly_score hasn't exceeded the threshold, how do I do this in modsecurity.
- 91
0
votes
0
answers
36
views
How to log custom http headers in ModSecurity Warning while using OWASP Core Rule Set
I have three custom HTTP headers called X-Username, X-Role and X-Realm, I want to log the content of this header in the warning logs when some of the the rules are matched for a HTTP request.
I have ...
- 91
0
votes
1
answer
82
views
Modsecurity parse nested keys in json
I am writing an exception rule. I have the JSON:
{"pageNumber":0,"pageSize":100,"sorts":[{"field":"hex","direction":"ASC"}],"...
- 1
0
votes
1
answer
256
views
How do I unblock a request uri in Modsecurity CRS?
I have installed a Nginx WAF with Modsecurity CRS. This WAF protects a backend WordPress.
One request from one of the plugins generated a false positive on the Modsecurity with the rule id 933120.
I ...
- 101
0
votes
0
answers
55
views
How to make the rules 920600 and 922110 dynamic to have custom charsets (custom regexp) in CRS 4 [duplicate]
There is a regexp in the rules 920600 and 922110 that (according to my opinion) accepts only 4 charsets in the Accept header. I need to make it custom, so the regexp must be modified based on my ...
user303436
0
votes
1
answer
1k
views
ModSecurity OWASP CRS 3.3.0 false positives on a Wordpress site
The following search queries are blocked by ModSecurity and returns a 403 forbidden error:
www.example.com/s=zip+someword &
www.example.com/s=gzip+someword
but not
www.example.com/s=zip & www....
