8000 Sandbox is wrong about in which PL a payload would be detected. · Issue #2450 · coreruleset/coreruleset · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Sandbox is wrong about in which PL a payload would be detected. #2450

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
mirkodziadzka-avi opened this issue Mar 25, 2022 · 11 comments
Closed

Sandbox is wrong about in which PL a payload would be detected. #2450

mirkodziadzka-avi opened this issue Mar 25, 2022 · 11 comments
Labels
sandbox Sandbox related problems

Comments

@mirkodziadzka-avi
Copy link

Describe the bug

More a minor / cosmetic problem.

Sending a request against the sandbox with

#!/usr/bin/env python3

import json
import requests

URL = "https://sandbox.coreruleset.org/"

message = {}

headers = {
    "X-Backend": "nginx",
    "X-CRS-Paranoia-Level": "2",
    "X-Format-Output": "txt-matched-rules-extended",
}
response = requests.get(URL, headers=headers)
print(response.text)

results in

This payload has been tested against the OWASP ModSecurity Core Rule Set 
web application firewall. The test was executed using the nginx engine and CRS version 3.3.2.

The payload is being detected by triggering the following rules:

913101 PL2 Found User-Agent associated with scripting/generic HTTP client
949110 PL1 Inbound Anomaly Score Exceeded (Total Score: 5)

CRS therefore detects this payload starting with paranoia level 1.

I think the last sentence is wrong.

While there is a PL1 rule in the log, it is only the anomaly score rule.
The rule which detects the payload is only in paranoia level 2.
So in PL1, the payload would not be detected.
@franbuehler
Copy link
Contributor
franbuehler commented Mar 25, 2022 •
edited
Loading

Thank you for your report.
I can confirm that the blocking rule is shown at PL1.
The response therefore incorrectly shows that the request is blocked starting with PL1.
We will check that.

@fzipi fzipi added the sandbox Sandbox related problems label Mar 26, 2022
@franbuehler franbuehler mentioned this issue Mar 28, 2022
Closed
@franbuehler franbuehler mentioned this issue Apr 25, 2022
Closed
@github-actions
Copy link
Contributor

This issue has been open 120 days with no activity. Remove the stale label or comment, or this will be closed in 14 days

@github-actions github-actions bot added the ⌛ Stale issue This issue has been open 120 days with no activity. label Jul 25, 2022
@fzipi
Copy link
Member
fzipi commented Jul 27, 2022

@mirkodziadzka-avi From what I see in the code, this depends on parsing the result of rules 980XXX and nginx is not logging those.

@fzipi
Copy link
Member
fzipi commented Jul 27, 2022

You can see the difference using:

curl -H 'x-crs-paranoia-level: 2' -H "x-backend: apache" -H 'User-Agent: python-requests/1.2' https://sandbox.coreruleset.org/get
curl -H 'x-crs-paranoia-level: 2' -H "x-backend: nginx" -H 'User-Agent: python-requests/1.2' https://sandbox.coreruleset.org/get

Those are the actual json logs from modsec 🤷

@mirkodziadzka-avi
Copy link
Author

@fzip I do not understand your comment. Even with apache, the log is

$ curl -H 'x-crs-paranoia-level: 2' -H "x-backend: apache" -H "X-Format-Output: txt-matched-rules-extended" -H 'User-Agent: python-requests/1.2' https://sandbox.coreruleset.org/get
This payload has been tested against the OWASP ModSecurity Core Rule Set 
web application firewall. The test was executed using the apache engine and CRS version nightly.

The payload is being detected by triggering the following rules:

913101 PL2 Found User-Agent associated with scripting/generic HTTP client
949110 PL1 Inbound Anomaly Score Exceeded (Total Score: 5)
980130 PL1 Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 0, 5, 0, 0


CRS therefore detects this payload starting with paranoia level 1.

where the last line is wrong. CRS would not detect this payload in PL 1 which can be seen by

$ curl -H 'x-crs-paranoia-level: 1' -H "x-backend: apache" -H "X-Format-Output: txt-matched-rules-extended" -H 'User-Agent: python-requests/1.2' https://sandbox.coreruleset.org/get
This payload has been tested against the OWASP ModSecurity Core Rule Set 
web application firewall. The test was executed using the apache engine and CRS version nightly.

No rules matched.

I agree, that this is a cosmetic problem (as mentioned in the first line of the ticket description)

@fzipi
Copy link
Member
fzipi commented Jul 27, 2022

Well, let me try to find out if that can be solved. From the comment on the txt-output, I thought the only way of getting it was from the 98XX rules.

@mirkodziadzka-avi
Copy link
Author

But even with 98xxxx in the apache case, it should parse the "0, 5, 0, 0" as PL2, right:

980130 PL1 Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 0, 5, 0, 0

@fzipi
Copy link
Member
fzipi commented Jul 27, 2022

Yes, but there is only one function for everything.

@github-actions github-actions bot removed the ⌛ Stale issue This issue has been open 120 days with no activity. label Jul 28, 2022
@fzipi
Copy link
Member
fzipi commented Jul 28, 2022

@mirkodziadzka-avi, can you retest now?

@mirkodziadzka-avi
Copy link
Author

@fzipi Seems to work fine and as expected. Thank You.

@fzipi
Copy link
Member
fzipi commented Jul 28, 2022

Thanks for filing this! Closing now.

@fzipi fzipi closed this as completed Jul 28, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
sandbox Sandbox related problems
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@fzipi @franbuehler @mirkodziadzka-avi
0