8000 932200 FP - URL with a query string encoded within a query string parameter · Issue #1835 · coreruleset/coreruleset · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content
8000

932200 FP - URL with a query string encoded within a query string parameter #1835

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
jamieburchell opened this issue Jul 3, 2020 · 8 comments
Closed

932200 FP - URL with a query string encoded within a query string parameter #1835

jamieburchell opened this issue Jul 3, 2020 · 8 comments
Assignees
@theMiddleBlue
Labels
➕ False Positive ⌛ Stale issue This issue has been open 120 days with no activity.

Comments

@jamieburchell
Copy link
jamieburchell commented Jul 3, 2020 •
edited
Loading

Description

The following request triggers a false positive:

/www/script.php?a=1&b=2&c=3&d=https%3A%2F%2Fwww.example.co.uk%2Fa%2Fb%2Fa-bc-z%2F25381&referer=https%3A%2F%2Fwww.example.co.uk%2Fa%2Fsearch%3Fb%3DBc%2Bz%26s%3D2019-08-01%26e%3D2021-04-30%26r%3D25%26d%3D&cb=6a22b65d22

Message: Warning. Pattern match "\\s" at MATCHED_VAR. [file "/etc/httpd/modsecurity.d/owasp-crs-modsecurity/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "633"] [id "932200"] [msg "RCE Bypass Technique"] [data "Matched Data: /search? found within MATCHED_VAR: https://www.example.co.uk/a/search?b=bc z&s=2019-08-01&e=2021-04-30&r=25&d="]

Audit Logs / Triggered Rule Numbers

Your Environment

  • CRS version: v3.3.0
  • Paranoia level setting: 2
  • ModSecurity version (e.g., 2.9.3): 2.9.2-1.el7
  • Web Server and version (e.g., apache 2.4.41): Apache 2.4.6-93.el7.centos
  • Operating System and version: CentOS 7

Confirmation

[X ] I have removed any personal data (email addresses, IP addresses,
passwords, domain names) from any logs posted.
@fzipi fzipi mentioned this issue Jul 13, 2020
Closed
@lifeforms
Copy link
Member

I also noticed this false positive. Do you think we could restrict the regexp, @theMiddleBlue ?

Maybe it's an option to exclude . character? URLs always contain dots, but true positives shouldn't have a dot (except when ../ path traversal is tried, but we have a separate rule to catch that)

@dune73 dune73 mentioned this issue Aug 17, 2020
Closed
@lifeforms
Copy link
Member

I was not thinking of all the options, you can do /usr/./bin/ls so just excluding . might not work. Maybe adding t:normalizePath would prevent that.

@lifeforms lifeforms mentioned this issue Sep 21, 2020
Closed
@jamieburchell jamieburchell mentioned this issue Nov 17, 2020
Closed
@github-actions
Copy link
Contributor

This issue has been open 120 days with no activity. Remove the stale label or comment, or this will be closed in 14 days

@github-actions github-actions bot added the ⌛ Stale issue This issue has been open 120 days with no activity. label Jan 20, 2021
@dune73
Copy link
Member
dune73 commented Jan 20, 2021

@theMiddleBlue, you got this issue assigned last Summer. I do not remember whether you volunteered or whether we pushed this on you. But either way, the issue is stale now and might get closed.

Are you still interested in fixing it?

@dune73
Copy link
Member
dune73 commented Jan 20, 2021

Here is my minimal call to trigger this FP at PL2:

$ curl "localhost/index.html?test=%2Fsearch%3Fb%3DBc%2Bz"

@theMiddleBlue
Copy link
Contributor
theMiddleBlue commented Jan 20, 2021 •
edited
Loading

I completely missed that, tnx. I'm working on it

@theMiddleBlue
Copy link
Contributor

I have a problem on reproducing it on Nginx+v3, it seems that both requests don't trigger any rules on my env.

Tried:
curl "http://localhost/www/script.php?a=1&b=2&c=3&d=https%3A%2F%2Fwww.example.co.uk%2Fa%2Fb%2Fa-bc-z%2F25381&referer=https%3A%2F%2Fwww.example.co.uk%2Fa%2Fsearch%3Fb%3DBc%2Bz%26s%3D2019-08-01%26e%3D2021-04-30%26r%3D25%26d%3D&cb=6a22b65d22"

curl "http://localhost/index.html?test=%2Fsearch%3Fb%3DBc%2Bz"

uhm, any hint? it can be possible that apache and nginx have different behavior in this specific rule?

@dune73
Copy link
Member
dune73 commented Jan 21, 2021

Hmm. I can reproduce it on NGINX easily.

Here is my config: issue-1835.zip

nginx: 1.13.2
modsecurity: 3.0.3
modsecurity-nginx: 1.0.0

@github-actions github-actions bot closed this as completed Feb 5, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@theMiddleBlue theMiddleBlue

Labels
➕ False Positive ⌛ Stale issue This issue has been open 120 days with no activity.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@dune73 @jamieburchell @lifeforms @theMiddleBlue
0