8000 Rule 932260 false positive with "scheduledAt" keyword · Issue #3288 · coreruleset/coreruleset · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Rule 932260 false positive with "scheduledAt" keyword #3288

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
thibauds opened this issue Aug 30, 2023 · 12 comments · Fixed by #3320
Closed

Rule 932260 false positive with "scheduledAt" keyword #3288

thibauds opened this issue Aug 30, 2023 · 12 comments · Fixed by #3320
Assignees
@RedXanadu
Labels
➕ False Positive PR available this issue is referenced by an active pull request v4 Should go into release v4

Comments

@thibauds
Copy link
thibauds commented Aug 30, 2023 •
edited by RedXanadu
Loading

Description

Our web application needs to sort events, we have different sorts and one of them is against a scheduledAt field.

How to reproduce the misbehavior

curl https://sandbox.coreruleset.org/events?sortBy=scheduledAt

Your Environment

  • CRS version (e.g., v3.3.4): default from sandbox
  • Paranoia level setting (e.g. PL1) : PL1
  • ModSecurity version (e.g., 2.9.6): default from sandbox
  • Web Server and version or cloud provider / CDN (e.g., Apache httpd 2.4.54): default from sandbox
  • Operating System and version: default from sandbox

Confirmation

[X] I have removed any personal data (email addresses, IP addresses,
passwords, domain names) from any logs posted.

Blocked by #3276
@airween
Copy link
Contributor
airween commented Aug 30, 2023

Hi @thibauds!

Thanks for your report. First, could you clarify your description? I mean you wrote:

  • CRS version (e.g., v3.3.4): default from sandbox

but it seems that Sandbox uses 4.0.0 without any argument (I checked your command above).

    "error_messages": [
      "[file \"apache2_util.c\"] [line 271] [level 3] [client 172.18.0.14] ModSecurity: Warning. Match of \"rx [0-9]\\\\\\\\\\\\\\\\s*\\\\\\\\\\\\\\\\'\\\\\\\\\\\\\\\\s*[0-9]\" against \"MATCHED_VAR\" required. [file \"/etc/modsecurity.d/owasp-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf\"] [line \"472\"] [id \"932260\"] [msg \"Remote Command Execution: Direct Unix Command Execution\"] [data \"Matched Data: sched found within MATCHED_VAR: scheduledAt\"] [severity \"CRITICAL\"] [ver \"OWASP_CRS/4.0.0-rc1\"] [tag \"modsecurity\"] [tag \"application-multi\"] [tag \"language-shell\"] [tag \"platform-unix\"] [tag \"attack-rce\"] [tag \"paranoia-level/1\"] [tag \"OWASP_CRS\"] [tag \"capec/1000/152/248/88\"] [tag \"PCI/6.5.2\"] [hostname \"localhost\"] [uri \"/events\"] [unique_id \"ZO8ScQS8FF8G3PGJJ9tHHQAAAIE\"]",
      "[file \"apache2_util.c\"] [line 271] [level 3] [client 172.18.0.14] ModSecurity: Warning. Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file \"/etc/modsecurity.d/owasp-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"] [line \"186\"] [id \"949110\"] [msg \"Inbound Anomaly Score Exceeded (Total Score: 5)\"] [ver \"OWASP_CRS/4.0.0-rc1\"] [tag \"modsecurity\"] [tag \"anomaly-evaluation\"] [hostname \"localhost\"] [uri \"/events\"] [unique_id \"ZO8ScQS8FF8G3PGJJ9tHHQAAAIE\"]",
      "[file \"apache2_util.c\"] [line 271] [level 3] [client 172.18.0.14] ModSecurity: Warning. Unconditional match in SecAction. [file \"/etc/modsecurity.d/owasp-crs/rules/RESPONSE-980-CORRELATION.conf\"] [line \"96\"] [id \"980170\"] [msg \"Anomaly Scores: (Inbound Scores: blocking=5, detection=5, per_pl=5-0-0-0, threshold=5) - (Outbound Scores: blocking=0, detection=0, per_pl=0-0-0-0, threshold=4) - (SQLI=0, XSS=0, RFI=0, LFI=0, RCE=5, PHPI=0, HTTP=0, SESS=0, COMBINED_SCORE=5)\"] [ver \"OWASP_CRS/4.0.0-rc1\"] [tag \"modsecurity\"] [tag \"reporting\"] [hostname \"localhost\"] [uri \"/events\"] [unique_id \"ZO8ScQS8FF8G3PGJJ9tHHQAAAIE\"]"
    ],

If you want to see only the triggered rules, you should use this command:

curl -H "x-format-output: txt-matched-rules" https://sandbox.coreruleset.org/events?sortBy=scheduledAt

This gives less details:

932260 PL1 Remote Command Execution: Direct Unix Command Execution
949110 PL1 Inbound Anomaly Score Exceeded (Total Score: 5)
980170 PL1 Anomaly Scores: (Inbound Scores: blocking=5, detection=5, per_pl=5-0-0-0, threshold=5) - (Outbound Scores: blocking=0, detection=0, per_pl=0-0-0-0, threshold=4) - (SQLI=0, XSS=0, RFI=0, LFI=0, RCE=5, PHPI=0, HTTP=0, SESS=0, COMBINED_SCORE=5)

The triggered rule is 932260, which exists only in 4.0, but not in 3.3.

As you can see in the rule's comment, the regexp was generated by crs-toolchain and the rule's regex file. This file includes several files, eg. unix-shell-4andup-with-params.ra, which contains the sched pattern. This is the cause.

We can check whether this is really a false positive or whether it is at this PL (PL1), but I'm afraid the solution now is that you make an exclusion against this rule (or against the rule and the affected target).

Let me know if I can help you that.

@dune73
Copy link
Member
dune73 commented Aug 30, 2023 •
edited
Loading

If foo=scheduleAt leads to an FP in 932260 PL1, we may want to discuss this before CRSv4 hits the street.

@thibauds
Copy link
Author

@airween I am sorry for the confusion about the version and my expectations.
Let me clarify:

  • You are right the version is 4.0.0.
  • I was not looking for a solution, I just wanted to raise attention (I was reading this blog post which recommends to report false positive on a PL 1 system). I am not knowledgeable enough to decide if this rule is acceptable or not, you can close this issue if you think that it is.

Thanks for your help and your great work.

@RedXanadu
Copy link
Member
RedXanadu commented Sep 4, 2023 •
edited
Loading

It appears that several plain English words are caught at PL 1 by rule 932260, including

bash
curl
shell
strings
unzip

$ curl https://sandbox.coreruleset.org/?word=strings -H 'x-format-output: txt-matched-rules'
932260 PL1 Remote Command Execution: Direct Unix Command Execution

I can understand how a judgement call might be made to live with FPs on bash, curl, and shell, as those seem like obvious targets. But strings and unzip I'm less sure about.

@dune73 dune73 mentioned this issue Sep 4, 2023
Closed
@theseion
Copy link
Contributor
theseion commented Sep 4, 2023

As discussed in the meeting, any PR for this issue should wait until #3276 has been merged.

@RedXanadu RedXanadu self-assigned this Sep 4, 2023
@theseion
Copy link
Contributor
theseion commented Sep 4, 2023

The idea is to solve this by adding English words in the command list (generated) to the "FP" list used by the rule.

@RedXanadu
Copy link
Member
RedXanadu commented Sep 8, 2023 •
edited
Loading

Note to self: waiting on #3276. Check again on Monday.

#3276 is still open. Check again next Monday.

(2023-09-18) #3276 is still open but nearly complete. Check again next Monday.

@RedXanadu RedXanadu mentioned this issue Sep 11, 2023
Merged
@dune73
Copy link
Member
dune73 commented Sep 12, 2023

We're getting there with #3276.

@theseion theseion added the v4 Should go into release v4 label Sep 19, 2023
@theseion
Copy link
Contributor

#3276.

See also #3189, which should fix the issue for user agents.

@RedXanadu
Copy link
Member
RedXanadu commented Sep 21, 2023 •
edited
Loading

@theseion So is this issue dependent on / blocked by #3189? Do I need to also wait for that to be completed? Or are those changes separate / will not conflict?

@theseion
Copy link
Contributor
theseion commented Sep 21, 2023 via email

@RedXanadu RedXanadu mentioned this issue Sep 25, 2023
Merged
@RedXanadu
Copy link
Member

'eval' and 'sched' now added to the Unix rules PL 1 exclusion/FP list.

Fixed in #3320.

@RedXanadu RedXanadu added the PR available this issue is referenced by an active pull request label Sep 25, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@RedXanadu RedXanadu

Labels
➕ False Positive PR available this issue is referenced by an active pull request v4 Should go into release v4
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix: Fix fps 932260 coreruleset/coreruleset
5 participants
@airween @theseion @dune73 @thibauds @RedXanadu
0