Closed
Description
This is the Agenda for the Monthly CRS Chat.
The general chat is going to happen on https://owasp.slack.com in the channel #coreruleset on Monday, 2021-12-06, at 20:30 CET. That's the 1st Monday of the month. A separate issue chat is happening at the same location, same time on Monday, 2021-12-20. That's the 3rd Monday of the month. Please note that we have a CRS calendar (maintained by @fzipi).
Items on the Agenda: (see previous meetings decisions: here)
What happend in the meantime since the chat last month
Outside development
- Blogpost at wpsec.com: CRS + WordPress
- Article about our workshop on how to avoid CVEs in the future in Portswigger's "Daily Swig"
- Blog Post by slik.nl / @lifeforms about their handling of the Apache path traversal weaknesses with the help of CRS
- OWASP HQ has forwarded a proposal to Trustwave to move ModSecurity under the OWASP umbrella. Trustwave has rejected this proposal as coming too early. They will reassess the situation at the end of 2022.
- The CRS project has added twitter to the channels that the dev-on-duty will cover
- Blog post Protecting WordPress with Open Source Web Application (WAF) Firewall ModSecurity + OWASP Core Rule Set (CRS)
PRs that have been merged since the last meeting
- Unified regexp-assemble toolchain #2223
- fix(sql): update rule to remove false positive #2248
- Fix capec for crawlers #2258
- Add Tests for Rule 920121 #2264
- test: add tests for 920341 #2266
- ci: add PR template example #2274
- Added new util script to find the longest data lenght in tests #2277
- Added new util script to find rules without test #2279
- NextCloud example in comments fix #2282
- Add 1 pos testcase for 932170 #2283
- Add 2 positive testcases for 932171 #2284
- Added a positive and a negative test cases for rule 920410 #2285
- Added tests for rule 932105 #2286
- Added tests for rule 932110 #2287
- fix 941170 #2292
- This PR adds two positive and a negative testcase for rule 932190. #2294
- Add test cases (1 neg, 2 pos) for rule 920171 #2295
- Rework and expand 920100 #2296
- Amend 920300 to exclude CONNECT requests #2297
- Disassemble 930100 regex #2298
- Move 941120 from PL1 to PL2 #2306
- Fixing Sybase FP #2307
- Add tests for 921180 #2308
- Resolve triple dot false negative in rule 930100 #2309
- Resolve triple dot false negative in rule 930110 #2310
- WordPress: add exclusion for aioseo plugin #2311
- Fixing FPs for PostgreSQL error messages #2313
- Web shells: Simplifying one of regexes #2315
- WordPress exclusions: Fix for FP #2320
- phpMyAdmin exclusions: Fix for FP #2321
- Fixing attack type of few rules #2324
We merged 31 PRs since the last monthly project chat.
Open PRs
- Removing old regexes from 942400 #2323
- fix 942350 #2300
- phpBB: Fixing FP and package deactivation #2299
- Sqli regex update to support comment blocks #2290
- Update send-payload-pls.sh #2288
- feat(ssrf): adds rules to check for IP based SSRF #2259
- Added crs-rules-check tool #2236
- Fixing Google OAuth2 detection #2222
- Fix 933210 Regex #2214
- Refactored and tested version of rule-ctl script #2193
- Replace NodeJS Rule Set #2163 - test does not pass for unknown reasons
Open PRs marked DRAFT or work in progress or needs action
- Nextcloud 20 false-positives #1975
- Draft: Plugins support + response body decompress plugin #1993
- Proposal for a new plugin: Machine Learning on ModSecurity #2067
- Detect JavaScript prototype pollution injection attempts #2070
- Exclusion list fot RoundCube webmail #2217
- fix: 933160 regex #2301
- fix: 933161 regex #2302
- fix 933180 regex #2303
- Email ruleset #2322
Other items
- Sandbox status: Release on Thu this week.
- Status page status: No update, we are still waiting for OWASP to tell us how to handle account registration - and more ideas how to expand go-ftw.
- Documentation status: Plugin blog post is almost ready, as is tuning documentation.
- Documentation: Is anyone interested in helping out by drafting the "where is the CRS used" content? We have two sections to be written: "Various Engine options" and "Various existing integrations in cloud and CDNs". The second one links in a bit with the Status Page project.
- Start a discussion about how the CRS should represent backslash characters in regular expressions in a portable way.
We currently use two different solutions, but we should probably be consistent and use (and document) one solution: but which solution is the clearest?- Some rules use:
\x5c - Some rules use:
[\\\\]
- Some rules use:
- Anomaly scoring variables are a mess. What do we want to do about it? This issue has a (limited) proposal: Refactor the CRS scoring variables #2319
Open Issues - Separate Issues Meeting (Monday, 2021-12-20)
- Dev-on-duty not covered for next week
- Important project infos
Status of issues covered last month
We covered 8 issues in the last meeting. This is their state:
- Issue slot 1: Fake Googlebot plugin #2227 + Fake bot plugin #2228 : Not clear which path we are going to adopt
- Issue slot 2: Add Windows triple dot to a PL1 rule #2205 : fixed
- Issue slot 3: Idea: Adaptive paranoia level #2240 : waiting for plugin
- Issue slot 4: Unable to acce 8FC5 ss a user's post PHPBB 3.3.3 #2150 : fixed
- Issue slot 5: New PL2/3 rule that catches mail (SMTP) injections #2206 : closed: PR is coming along nicely
- Issue slot 6: Add exclusion set for OData standard #2127 : on the backlog, waiting for a volunteer
- Issue slot 7: Google OAuth2 plugin #2232 - waiting for plugin
- Issue slot 8: Plugins: Config file is not loaded before rules #2246 - conversation continues
Stats
- Covered in chat: 8
- Closed: 3
- Pending: 5
This month's issues
There are 29 open issues at the beginning of the issue chat.
We generally cover 10 issues per month in a separate issue meeting. Add them as you see fit.
- Issue slot 1: Refactor the CRS scoring variables #2319 (probably this covers also Bug in how the variables
tx.inbound_anomaly_scoreis used? #1896) - Issue slot 2: Add documentation for the sandbox #2312 - we are getting closer to release date, this should be ready to go.
- Issue slot 3: Replace NodeJS Rule Set #2163 - still can't get this working, and we need this for feat(ssrf): adds rules to check for IP based SSRF #2259
- Issue slot 4: False negative in 942230 #2230
- Issue slot 5: Fake Googlebot plugin #2227 + Fake bot plugin #2228
- Issue slot 6: The Big Backslash Hunt #2332
- Issue slot 7: Rule against CVE-2021-44228 #2331 - what to do with the log4j rule and the existing 932130?
- Issue slot 8: SQLi using scientific notation not detected at PL1 #2318 - volunteer to write a new sqli rule needed
- Issue slot 9: #FIXME
- Issue slot 10: #FIXME
How to get to our slack and join the meeting?
If you are not yet on the OWASP Slack, here is your invite: https://owasp-slack.herokuapp.com/ .
Everybody is welcome to join our community chat.