Monthly Chat Agenda July (2021-07-05 and 2021-07-19) #2141

dune73 · 2021-06-25T06:56:51Z

This is the Agenda for the Monthly CRS Chat.

The general chat is going to happen on https://owasp.slack.com in the channel #coreruleset on Monday, 2021-07-05, at 20:30 CET. That's the 1st Monday of the month. A separate issue chat is happening at the same location, same time on Monday, 2021-07-19. That's the 3rd Monday of the month. Please note that we have a CRS calendar (maintained by @fzipi).

Items on the Agenda: (see previous meetings decisions: here)

What happend in the meantime since the chat last month

Outside development

Aiz00ngroup CVE monitoring / custom rule service launched (-> FIXME: @themiddle, please provide link)
On-site / online presentation of "WAF - An Introduction" in German by @franbuehler at a Guild42 event: https://guild42.ch/event/web-application-firewall-online/
CVE-2021-35638
Andrew Howe's write-up of CVE-2021-35638
Daily Swig article about CVE-2021-35638
Fzipi reports that Juan Pablo is making progress with his Coraza WAF running CRS on Caddyserver. He's expecting a release soon.

PRs that have been merged since the last meeting

Fix for issue #1922 #1958: Fix for issue Rules blocking Google OAuth2 redirect (callback) URLs #1922
fix(tests): use only valid yaml in tests #2080: fix(tests): use only valid yaml in tests
feat(copyright): update copyright to new organization #2086: feat(copyright): update copyright to new organization
Improve sampling efficiency2 #2094: Improve sampling efficiency2
A small cosmetic fix: added missing space after comment mark #2097: A small cosmetic fix: added missing space after comment mark
Added a note to a commented rule about unsupported action in v3 #2098: Added a note to a commented rule about unsupported action in v3
Little performance fixies #2106: Little performance fixies
fix(ci): try fixing stale issues workflow #2111: fix(ci): try fixing stale issues workflow
fix_#2110 #2112: fix_#2110
Fix_#2113 #2115: Fix_#2113
feat(ftw): initial go-ftw running version #2120: feat(ftw): initial go-ftw running version
fix#2119 #2121: fix#2119
Add link to slack invitation to README #2122: Add link to slack invitation to README
Update SECURITY.md #2124: Update SECURITY.md
feat(rce): extend Unix RCE commands #2129: feat(rce): extend Unix RCE commands
Owncloud: Fix rule 9003001 to match both dav and webdav #2130: Owncloud: Fix rule 9003001 to match both dav and webdav
feat(button): add github funding button #2131: feat(button): add github funding button
fix(url): change to coreruleset domain #2132: fix(url): change to coreruleset domain
Replace Blacklist and Whitelist with Deny list and Allow list #2137: Replace Blacklist and Whitelist with Deny list and Allow list
drupal: fix CVE-2021-35368 bypass (authored by Christian Folini) #2143: drupal: fix CVE-2021-35368 bypass (authored by Christian Folini)
scanners: add QQGameHall UA #2144: scanners: add QQGameHall UA

We merged 21 PRs since the last monthly project chat.

Open PRs

Body decompress plugin registration plugin-registry#3
Move 941310 from PL1 to PL2 #2014: Move 941310 from PL1 to PL2 -- @franbuehler proposes to abandon this
932200 Linux RCE evasion with (more) uninitialized bash parameters #2052: 932200 Linux RCE evasion with (more) uninitialized bash parameters
Add rule-ctl.py script #2068: Add rule-ctl.py script
Adding word boundary to lower FPs #2078: Adding word boundary to lower FPs
Fix FP 953120 brotli compression #2101: Fix FP 953120 brotli compression
Use chained end tag detection for rule 941310 #2107: Use chained end tag detection for rule 941310
Web shells - alternative version #2116: Web shells - alternative version
Replaced the original regexp-assemble.pl script with the v2 version. #2136: Replaced the original regexp-assemble.pl script with the v2 version.
Remove Rule 910110 #2148: Remove Rule 910110

Open PRs marked DRAFT or work in progress or needs action

Nextcloud 20 false-positives #1975: Nextcloud 20 false-positives
Draft: Plugins support + response body decompress plugin #1993: Draft: Plugins support + response body decompress plugin
Override modsec rule 200001 #2049: Override modsec rule 200001
fix ReDoS on 941140 #2050: fix ReDoS on 941140
New XXE rule file (again) #2061: New XXE rule file (again)
Proposal for a new plugin: Machine Learning on ModSecurity #2067: Proposal for a new plugin: Machine Learning on ModSecurity
Detect JavaScript prototype pollution injection attempts #2070: Detect JavaScript prototype pollution injection attempts

Other items

Status of go-ftw?
Dev Summit in October in Switzerland: non-binding commitment: Who plans to join us from the weekend of October 23/24 for one week of CRS and having fun?
When you install a plugin, should it become active immediately, or should there be an "enable" config item in the plugin?
Fill up dev-on-duty schedule for combing weeks

Open Issues - Separate Issues Meeting (Monday, FIXME)

Status of issues covered last month

Issue slot 1: FPs with Cloudflare proxy and paranoia 4 #2117 FPs with Cloudflare proxy and paranoia 4 - to solve or not to solve? - closed - Policy is, we don't fix PL4.
Issue slot 2: Extend util/regexp-assemble/regexp-93210X.txt with additional unix commands #2128 Extend util/regexp-assemble/regexp-93210X.txt with additional unix commands - PR available: feat(rce): extend Unix RCE commands #2129
Issue slot 3: Add exclusion set for OData standard #2127 Add exclusion set for OData standard - @theseion takes this and @fzipitria coaches him
Issue slot 4: Sort out FPs around Matomo cookies #2109 Sort out FPs around Matomo cookies - It only affects PL2 -> blog post on how to handle this - @lifeforms
Issue slot 5: Rule id: 930100 does not check for Single dot directory and semicolon #2105 Rule id: 930100 does not check for Single dot directory and semicolon - close this with explanation and ask the reporter to explain the problem
Issue slot 6: Error 403 when saving settings at /wp-admin/index.php?page=aioseo-setup-wizard#/category #2095 Error 403 when saving settings at /wp-admin/index.php?page=aioseo-setup-wizard#/category - @lifeforms
Issue slot 7: Replace references to blacklist and whitelist with denylist and allowlist respectively #2083 Replace references to blacklist and whitelist with denylist and allowlist respectively - is addressed by Replace blacklist and whitelist with deny list and allow list #2084, but a new PR will be created by Paul
Issue slot 8: False positive on parameter value XMLNS #2071 False positive on parameter value XMLNS - @lifeforms
Issue slot 9: Broken testcase for 932100 #2062 Broken testcase for 932100 - @fzipi
Issue slot 10: Rule Id: 932150 false positive on time keyword #2044 Rule Id: 932150 false positive on time keyword - @franbuehler and @lifeforms

Stats

Covered in chat: 10
Closed: 4
Pending: 6

This month's issues

We generally cover 10 issues per month in a separate issue meeting. Add them as you see fit.

Issue slot 1: Go Test WAF bypasses #1991 - Several new bypasses based on a test suite released by Wallarm
Issue slot 2: 942310 regular suspected error #2118 - assigned to @franbuehler, waiting for support from @themiddle
Issue slot 3: False Positive with word Ping in 932115 #2135 - tough case with several FPs of the keyword "Ping Pong"
Issue slot 4: LogPart E (ctl:auditLogParts=+E) being added without matching as a rule #2139 - potential error with a ctl statement applied after a match in a first rule of a chain, yet @franbuehler could not reproduce
Issue slot 5: Rule id 930110 Bypass #2140 - ..\<anything> is not detected as a path traversal attack
Issue slot 6: WordPress /wp-admin/site-health.php triggers #2142 - Potential addition to the WP rule exclusion package
Issue slot 7: Unable to access a user's post PHPBB 3.3.3 #2150 - PHPBB FP
Issue slot 8: Help create rule for Wordpress and ACF (Advanced Custom Fields) #2066 - Simple FP case, rule exclusion already provided
Issue slot 9: probably leaving empty due to Summer holiday
Issue slot 10: probably leaving empty due to Summer holiday

How to get to our slack and join the meeting?

If you are not yet on the OWASP Slack, here is your invite: https://owasp-slack.herokuapp.com/ .

Everybody is welcome to join our community chat.

The text was updated successfully, but these errors were encountered:

franbuehler · 2021-07-05T19:11:35Z

Decisions

PRs

Body decompress plugin registration plugin-registry#3 - @fzipi, @azurit and @airween will review this PR
Move 941310 from PL1 to PL2 #2014: Move 941310 from PL1 to PL2 -- @franbuehler proposes to abandon this - we agree on closing this PR - closed
932200 Linux RCE evasion with (more) uninitialized bash parameters #2052: 932200 Linux RCE evasion with (more) uninitialized bash parameters - @azurit volunteers to write some tests
Add rule-ctl.py script #2068: Add rule-ctl.py script - @airween will review it and send a fix - @theseion wants to test it
Adding word boundary to lower FPs #2078: Adding word boundary to lower FPs - @theseion and @azurit will make it ready to be merged
Fix FP 953120 brotli compression #2101: Fix FP 953120 brotli compression - @azurit would like to do more tests on this
Use chained end tag detection for rule 941310 #2107: Use chained end tag detection for rule 941310 - We leave it at PL1 and see if there are more FPs being reported in the future.
Web shells - alternative version #2116: Web shells - alternative version - @azurit will change the PR and @fzipi will merge it.
Replaced the original regexp-assemble.pl script with the v2 version. #2136: Replaced the original regexp-assemble.pl script with the v2 version - @franbuehler will review it
Remove Rule 910110 #2148: Remove Rule 910110 - @airween and Paul Beckett will work on this

Other items

Status of go-ftw? - It's basically done, it runs in parallel now to get more testing and we plan to replace ftw with the super fast go-ftw after the next release.
Dev Sumit in October in Switzerland (Oct 23/24 until Oct 30): non-binding commitment: Who plans to join us from the weekend of October 23/24 for one week of CRS and having fun?
- Max: 1st weekend
- Airween: Full week
- Felipe: Full week
- Christian: Full week
- Walter: Full week
- Don't know yet: Fränzi, fgs, Chaim, theMiddle, Azurit, Emphazer, Spartantri
When you install a plugin, should it become active immediately, or should there be an "enable" config item in the plugin? - No decision yet
Fill up dev-on-duty schedule for combing weeks

Open Issues - Separate Issues Meeting (Monday, July 19)

Issue slot 1:
Issue slot 2:
Issue slot 3:
Issue slot 4:
Issue slot 5:
Issue slot 6:
Issue slot 7:
Issue slot 8:
Issue slot 9:
Issue slot 10:

dune73 added the ➕ False Positive label Jun 25, 2021

azurit added 🔖 Meeting Agenda and removed ➕ False Positive labels Jun 28, 2021

airween mentioned this issue Jul 19, 2021

Remove Rule 910110 #2148

Merged

dune73 closed this as completed Aug 2, 2021

dune73 mentioned this issue Aug 2, 2021

Monthly Chat Agenda August 2021 (2021-08-02 and 2021-08-16) #2169

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Monthly Chat Agenda July (2021-07-05 and 2021-07-19) #2141

Monthly Chat Agenda July (2021-07-05 and 2021-07-19) #2141

Uh oh!

Uh oh!

Monthly Chat Agenda July (2021-07-05 and 2021-07-19) #2141

Monthly Chat Agenda July (2021-07-05 and 2021-07-19) #2141

Comments

Uh oh!

What happend in the meantime since the chat last month

Outside development

PRs that have been merged since the last meeting

Open PRs

Open PRs marked DRAFT or work in progress or needs action

Other items

Open Issues - Separate Issues Meeting (Monday, FIXME)

Status of issues covered last month

This month's issues

How to get to our slack and join the meeting?

Uh oh!

Decisions

PRs

Other items

Open Issues - Separate Issues Meeting (Monday, July 19)

Uh oh!