10000 Rule Id: 932150 false positive on time keyword · Issue #2044 · coreruleset/coreruleset · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Rule Id: 932150 false positive on time keyword #2044

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
noneisland opened this issue Mar 25, 2021 · 16 comments · Fixed by #2819
Closed

Rule Id: 932150 false positive on time keyword #2044

noneisland opened this issue Mar 25, 2021 · 16 comments · Fixed by #2819
Assignees
@franbuehler
Labels
➕ False Positive

Comments

@noneisland
Copy link

Description

Request "/api/v1/query?q=time+warner", "GET", "1.1" returned 403.

Rule Id: 932150 phase: 2

  • Match, but no disruptive action: ModSecurity: Warning. Matched "Operator Rx' with parameter (?:^|=)\s*(?:{|\s*(\s*|\w+=(?:[^\s]|$.|$.|<.|>.|'.'|".")\s+|!\s|$)\s(?:'|")(?:[?*[]()-|+\w'"./\\]+/)?[\\'"](?:l[\\'"](?:s(?:[\\'"](?:b[\\'"]*_[\\'"]*r (6252 characters omitted)' against variable ARGS:q' (Value: time warner' ) [file "/opt/coreruleset/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "444"] [id "932150"] [rev ""] [msg "Remote Command Execution: Direct Unix Command Execution"] [data "Matched Data: time found within ARGS:q: time warner"] [severity "2"] [ver "OWASP_CRS/3.3.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname ""] [uri "/api/v1/query"] [unique_id "161670536857.434291"] [ref "o0,5v20,11"]

Log: [client ] ModSecurity: Access denied with code 403 (phase 2). Matched "Operator Ge' with parameter 5' against variable TX:ANOMALY_SCORE' (Value: 5' ) [file "/opt/coreruleset/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "138"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "2"] [ver "OWASP_CRS/3.3.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname ""] [uri "/api/v1/query"] [unique_id "161670536857.434291"] [ref ""]
Intervention, returning code: 403

Your Environment

  • CRS version: default v3.4/dev
  • Paranoia level setting:
  • ModSecurity version : 3.0.4
  • Web Server and version :
  • Operating System and version: Amazon Linux 2

Confirmation

[x ] I have removed any personal data (email addresses, IP addresses,
passwords, domain names) from any logs posted.
@noneisland noneisland mentioned this issue Apr 1, 2021
Closed
@franbuehler franbuehler self-assigned this Apr 12, 2021
@franbuehler franbuehler mentioned this issue Apr 12, 2021
Closed
@franbuehler
Copy link
8000 Contributor

Hi @noneisland

Did you see my comment in #2047 (comment)??
You wrote there that you would like to resolve this reported issue here. But I wanted to ask you if I can help you with it?

@dune73
Copy link
Member
dune73 commented Apr 19, 2021

We talked about this in the April issue chat. Here is our conclusion:

@flo405 has a plan how to solve this plus some additional bypasses. He will coordinate with @franbuehler who self-assigned.

@noneisland
Copy link
Author

Hi @franbuehler

Thank you for your reply.

I understand that we can fix it by modifying the regex, is there a guide how you build and test the change?

@dune73 dune73 mentioned this issue May 17, 2021
Closed
@lifeforms lifeforms self-assigned this May 17, 2021
@lifeforms
Copy link
Member

In order to modify the regexp, it is the same procedure that I described in #2071 (comment). After changing the source patterns, the compressed regexp has to be built.

I'm not exactly up to date on the proposed change but will be very interested to hear more.

@franbuehler
Copy link
Contributor

Hi @noneisland

Do you have any updates here?

@franbuehler
Copy link
Contributor

Or does @flo405 have any updates?

@dune73 dune73 mentioned this issue Jun 21, 2021
Closed
@dune73
Copy link
Member
dune73 commented Jun 23, 2021

We talked about this issue at our recent project meeting.

Decision: We have not heard from @flo405 anymore, so it's likely we have to start over from scratch ourselves. @franbuehler and @lifeforms agreed to take this on.

@noneisland
Copy link
Author

Hi @noneisland

Do you have any updates here?

I'm willing to help.

But I am not sure how to build and test the changes.

Instructions on how to build the changes from scratch will help.

@dune73
Copy link
Member
dune73 commented Jun 23, 2021

Thank you @noneisland. You'll hear from @franbuehler or @lifeforms soon.

@dune73 dune73 mentioned this issue Jul 19, 2021
Closed
@dune73
Copy link
Member
dune73 commented Jul 19, 2021

We'll not so soon it seems. But this is not forgotten.

@lifeforms
Copy link
Member

I tried an approach which was not fruitful and I have to dig into it more. Thanks for your patience.

@dune73
Copy link
Member
dune73 commented Nov 15, 2021

Any update here @lifeforms?

@dune73 dune73 mentioned this issue Nov 15, 2021
Closed
3 tasks
@franbuehler franbuehler removed their assignment Nov 15, 2021
@lifeforms lifeforms mentioned this issue Feb 7, 2022
Closed
@franbuehler
Copy link
Contributor

I like @lifeforms idea in the linked issue #2166:

time can be used to execute any command (e.g. time ls). We could amend the existing RCE rules so they have time as an optional prefix to the wordlist e.g. (?:time\s+)?

So I went through all the RCE rule files and found some rules that we could enhance with a prefix time.

PL1:
932100 - Remote Command Execution: Unix Command Injection -> add time to the prefix comment of 932100.data.
932105 - Remote Command Execution: Unix Command Injection -> same here
932110 - Remote Command Execution: Windows Command Injection -> same here if attack exists for Windows??
932115 - Remote Command Execution: Windows Command Injection -> same here if attack exists for Windows??
932120 - Remote Command Execution: Windows PowerShell Command Found -> not applicable
932130 - Remote Command Execution: Unix Shell Expression Found -> not applicable
932140 - Remote Command Execution: Windows FOR/IF Command Found -> not applicable
932150 - Remote Command Execution: Direct Unix Command Execution -> add time to the prefix comment in data file and remove time
932160 - Remote Command Execution: Unix Shell Code Found -> not applicable
932170 - Remote Command Execution: Shellshock (CVE-2014-6271) -> not applicable
932171 - Remote Command Execution: Shellshock (CVE-2014-6271) -> not applicable
932180 - Restricted File Upload Attempt -> not applicable
PL2:
932101 - Remote Command Execution: Unix Command Injection -> not applicable
932200 - RCE Bypass Technique -> add time to the prefix comment of data file as time would be a bypass technique.
932210 - Remote Command Execution: SQLite System Command Execution -> not applicable?
932300 - Remote Command Execution: SMTP Command Execution -> not applicable
932310 - Remote Command Execution: IMAP Command Execution -> not applicable
932320 - Remote Command Execution: POP3 Command Execution -> not applicable
PL3:
932106 - Remote Command Execution: Unix Command Injection -> add time to the prefix comment in data file
932190 - Remote Command Execution: Wildcard bypass technique attempt -> not applicable
932301 - Remote Command Execution: SMTP Command Execution -> not applicable
932311 - Remote Command Execution: IMAP Command Execution -> not applicable
932321 - Remote Command Execution: POP3 Command Execution -> not applicable

Would this be a possible way to go??

This was referenced Apr 18, 2022
Closed
Closed
@github-actions
Copy link
Contributor

This issue has been open 120 days with no activity. Remove the stale label or comment, or this will be closed in 14 days

@github-actions github-actions bot added the ⌛ Stale issue This issue has been open 120 days with no activity. label Jul 20, 2022
@github-actions github-actions bot closed this as completed Aug 3, 2022
@dune73 dune73 removed the ⌛ Stale issue This issue has been open 120 days with no activity. label Aug 3, 2022
@dune73 dune73 reopened this Aug 3, 2022
@dune73
Copy link
Member
dune73 commented Aug 3, 2022

This is not completed and we need to fix this.

@franbuehler
Copy link
Contributor
franbuehler commented Sep 29, 2022 •
edited
Loading

I'll update the following rules (see my comment above)

  • 932100
  • 932105
  • 932150
  • 932106

Windows:

  • 932110
  • 932115

@franbuehler franbuehler mentioned this issue Sep 29, 2022
Merged
@franbuehler franbuehler linked a pull request Sep 29, 2022 that will close this issue
fix(935E1D91): add time keyword again #2819
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@franbuehler franbuehler

Labels
➕ False Positive
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix(935E1D91): add time keyword again franbuehler/coreruleset
4 participants
@dune73 @lifeforms @franbuehler @noneisland
0