REQUEST-944-APPLICATION-ATTACK-JAVA.conf #990
Comments
|
User fzipi commented on date 2018-01-01 16:58:54: Shouldn't this be 2018 now? |
|
User fzipi commented on date 2018-01-01 17:00:18: Is this normal indentation? |
|
User fzipi commented on date 2018-01-01 17:01:03: This 'SecRule' should be aligned with the previous 'chain' |
|
User fzipi commented on date 2018-01-01 17:01:58: This 'SecRule' should be aligned with the previous 'chain' |
|
User fzipi commented on date 2018-01-01 17:02:10: Same here. |
|
User spartantri commented on date 2018-01-02 15:44:09: Fixed all those, sorry about that, it is my personal identation style to distinguish short chains, anyway, removed all those extra 4 spaces to allign to contributing.md |
|
User spartantri commented on date 2018-01-02 15:44:33: I don't know but changed anyway |
|
User lifeforms commented on date 2018-02-04 19:10:15: Why do we have |
|
User lifeforms commented on date 2018-02-04 19:14:28:
|
|
User lifeforms commented on date 2018-02-04 19:18:20: I notice this rule is in Paranoia Level 3, which feels a bit high for me, since the rule is pretty nice and I think the byte sequence should be rare... Have you found false positives on this rule? I would advocate Paranoia Level 1 or if you found FPs Paranoia Level 2 |
|
User lifeforms commented on date 2018-02-04 19:20:18: This rule seems pretty specific and not prone to FP, what about moving it to a lower Paranoia Level like 2? |
|
User lifeforms commented on date 2018-02-04 19:21:31: Is this rule duplicate? |
|
User spartantri commented on date 2018-02-05 10:10:23: You are right, I wrote these with an empty ruleset first so put this here to make sure it worked, I will remove this, and add a comment about it |
|
User spartantri commented on date 2018-02-05 18:26:29: I'm not sure how common this may be for legitimate purposes so let's start with 3 and lower it once we have some feedback. |
|
User spartantri commented on date 2018-02-05 18:27:57: fixed, missed that one |
|
User spartantri commented on date 2018-02-05 18:37:14: no there is no chain in this one is intended to complain on most common keywords to spawn a process |
|
User spartantri commented on date 2018-02-05 18:38:08: changed the message to class lets add this into a new rule, maybe a new PR if required |
|
User spartantri commented on date 2018-02-05 18:48:50: Added to 944230 and class list into java-classes.data |
|
User lifeforms commented on date 2018-02-05 20:46:19: We leave this in for now and create a separate issue on how to handle this generally in setup/initialization file. |
|
User spartantri commented on date 2018-02-06 18:11:36: lifeforms There are no false negative on my tests but some of the rules were on pass instead of block for testing, changed all back to block, please test again [Tue Feb 06 19:04:15.778459 2018] [:error] [pid 13977] [client 127.0.0.1] ModSecurity: Warning. Matched phrase "com.opensymphony.xwork2" at ARGS_NAMES:redirect:${#matt= #context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse'),#matt.setContentType('text/plain'),#matt.getWriter().println ('successsuccess'),#matt.getWriter().flush(),#matt.getWriter().close()}. [file "/home/spartan/owasp-modsecurity-crs/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf"] [line "160"] [id "944230"] [rev "1"] [msg "Suspicious Java class detected"] [data "Matched Data: redirect:${#matt= #context.get('com.opensymphony.xwork2.dispatcher.httpservletresponse'),#matt.setcontenttype('text/plain'),#matt.getwriter().println ('successsuccess'),#matt.getwriter().flush(),#matt.getwriter().close()} found within ARGS_NAMES:redirect:${#matt= #context.get('com.opensymphony.xwork2.dispatcher.HttpServletResponse'),#matt.setContentType('text/plain'),#matt.getWriter().println ('successsuccess'),#matt.getWriter().flush(),#matt.getWriter().close()}"] [severity "NOTICE"] [ver "OWASP_CRS/3.1.0"] [tag "application-multi"] [tag "l [hostname "localhost"] [uri "/"] [unique_id "WnnuH38AAQEAADaZIF4AAAAK"] |
Issue for tracking original pull request created by user spartantri on date 2017-12-28 22:09:36.
Link to original PR: SpiderLabs/owasp-modsecurity-crs#990.
HEAD is: e8cc868
BASE is: ce36ede
Java attacks updated config
The text was updated successfully, but these errors were encountered: