7
votes
Why is PUT Request not allowed by default in OWASP CoreRuleSet
I suspect that this is largely a legacy thing, because the list of allowed methods (GET HEAD POST OPTIONS) in the CRS hasn't changed for at least 12 years and probably longer.
Historically the PUT ...
- 16.7k
5
votes
Accepted
Why Owasp-crs does not allow Content-Type: application/x-www-form-urlencoded
... "Content-Type: application/x-www-form-urlencoded;"
^^^
A semicolon is the delimiter between the content type and additional parameters ...
- 208k
3
votes
Accepted
OWASP CRS - Is "%00" in request form body is false positive?
I would expect a web server to properly handle that in form data, therefore I see it as false positive, but I am not sure.
This is a dangerous assumption to make, and by the same argument you could ...
- 16.7k
2
votes
Accepted
How to put specific rules in OWASP core ruleset in detection mode?
You are probably using CRS 4 and running it in Anomaly Scoring mode (which is the default). In this mode, rules are not directly blocking anything and all of them are set to pass (see SecDefaultAction ...
- 86
2
votes
Accepted
Cannot allow 920600 in crs
CRS dev-on-duty here. Thank you for providing the logs.
As you have already spotted, you have a problem with OWASP CRS rule 920600 that checks for Illegal Accept header: charset parameter.
Your Accept ...
- 384
2
votes
Accepted
ModSecurity CRS, allow header `accept-charset`
OWASP ModSecurity Core Rule Set Dev on Duty reporting. If you're working with a CRS v3 installation then you can configure CRS to allow the Accept-Charset header by removing it from the 'tx....
- 231
2
votes
Updating regular expressions for the rules 920600, 921421, 921422 and 922110 in CRS 3.3.4
CRS Dev-On-Duty here. What would you like to achieve or why would you like to update the rules? We do not recommend to directly change the rules, but instead to tune them. Have a look at this tuning ...
- 384
1
vote
Why is PUT Request not allowed by default in OWASP CoreRuleSet
I'm not sure there is any strict reason why only the GET, HEAD, POST and OPTIONS methods are allowed by default. I assume CRS tries to minimize the risk, and these are enough for more users.
You can ...
- 201
1
vote
owasp crs 3.0 rule functuonalityconsult
CRS co-lead here. First, I would recommend to use the newest release of CRS 3.2.2: https://coreruleset.org/installation/ Usually you can just delete your old coreruleset files (maybe keeping your crs-...
- 11
1
vote
Accepted
Increasing critical_anomaly_score does not block request
This was resolved on CRS github page and problem was with some custom modifications to CRS done by a user.
- 86
1
vote
Accepted
Modsecurity only show warning but not blocking?
You have misconfigured your CRS installation. Also, the link to the documentation you are refering to is very old and even points to the old, unused github account and repository. The current CRS ...
- 86
1
vote
Modsecurity only show warning but not blocking?
Having only the names of the config files instead of their actual content is only barely useful, since one can only guess what the content of the config might be.
Check SecDefaultAction in your crs-...
- 208k
Only top scored, non community-wiki answers of a minimum length are eligible