8000 Email ruleset by fzipi · Pull Request #2322 · coreruleset/coreruleset · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Email ruleset #2322

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Mar 7, 2022
Merged

Email ruleset #2322

merged 2 commits into from
Mar 7, 2022

Conversation

fzipi
Copy link
Member
@fzipi fzipi commented Dec 5, 2021

These are two new rules for dealing with email related protocol remote commands (smtp/pop3/imap4).

  • New rule 932300 tries to capture base commands that are different enough from common English words to prevent FP
  • New rule 932310 is a stricter sibling in PL3 with all the remaining commands

Still to be defined to be considered for merging:

  • the prefix/suffix for matching commands
  • tests!

@fzipi fzipi added the 🚀 enhancement New feature or request label Dec 5, 2021
@fzipi fzipi mentioned this pull request Dec 5, 2021
Closed
@fzipi fzipi force-pushed the 2206-email-ruleset branch from 0e2f017 to 731023e Compare December 5, 2021 13:30
@fzipi fzipi linked an issue Dec 6, 2021 that may be closed by this pull request
New PL2/3 rule that catches mail (SMTP) injections #2206
Closed
@dune73
Copy link
Member
dune73 commented Dec 6, 2021

Cool stuff. Thank you.

  • What do you mean by "the prefix/suffix for matching commands"
  • PL3 rule sets PL2 score

@fzipi
Copy link
Member Author
fzipi commented Dec 6, 2021

Prefix/suffix as the ones we use for generating the rule with regexp-assembly.py (opening regex/closing regex). Originally @NiceYouKnow wrote prefix (?s)\r\n.*?\b, and suffix \b and you added prefix (^|[\r\n]) and suffix \s. Maybe @azurit has some other idea 😄

@dune73
Copy link
Member
dune73 commented Dec 6, 2021

Gotcha. Thanks.

Please fix the scoring PL for the 2nd rule.

@fzipi fzipi force-pushed the 2206-email-ruleset branch from 731023e to 0bf9243 Compare December 6, 2021 15:07
@dune73
Copy link
Member
dune73 commented Dec 6, 2021

Thanks

@fzipi fzipi force-pushed the 2206-email-ruleset branch from 0bf9243 to 1fe3f02 Compare December 18, 2021 14:17
@fzipi
Copy link
Member Author
fzipi commented Dec 18, 2021

Ok, first pass on splitting the rules.

  • The SMTP rules are probably mostly at PL2, because most of the commands are short and don't match an English word
  • Added tests for SMTP
  • IMAP rules will be mostly at PL3 probably. Still need to refactor this one a bit, but most commands are simple English words prone to FP.
  • Still need to review POP3, but will be similar to SMTP mostly.

@dune73
Copy link
Member
dune73 commented Dec 19, 2021

This looks good. Thank you.

Few items:

  • RFC 5321 lacks a link (unlike other RFC mentioned)
  • not sure if you should escape the space in the NOOP regex

@fzipi fzipi force-pushed the 2206-email-ruleset branch from 1fe3f02 to 695759b Compare December 19, 2021 22:45
@fzipi
Copy link
Member Author
fzipi commented Dec 19, 2021 •
edited
Loading
  • Added link per comment
  • Added POP3 in PL2 and PL3
  • IMAP4 is more complex protocol, still parsing it
  • Still needs plenty of tests

@fzipi fzipi force-pushed the 2206-email-ruleset branch 2 times, most recently from 9c7191f to c3d18e1 Compare December 20, 2021 06:09
@dune73 dune73 mentioned this pull request Dec 20, 2021
Closed
@fzipi fzipi force-pushed the 2206-email-ruleset branch 2 times, most recently from 163be9d to 97bb811 Compare December 23, 2021 21:10
@fzipi
feat(rules): add email ruleset
212c1af 
Signed-off-by: Felipe Zipitria <felipe.zipitria@owasp.org>
@fzipi fzipi force-pushed the 2206-email-ruleset branch 2 times, most recently from abab70e to fafd0aa Compare December 25, 2021 15:39
@fzipi
feat(email): add new email remote command execution rule
ba8a090 
Signed-off-by: Felipe Zipitria <felipe.zipitria@owasp.org>
@fzipi fzipi force-pushed the 2206-email-ruleset branch from fafd0aa to ba8a090 Compare December 25, 2021 15:51
@fzipi fzipi marked this pull request as ready for review December 25, 2021 15:52
@fzipi
Copy link
Member Author
fzipi commented Dec 25, 2021

🎄 Email ruleset!

@fzipi
Copy link
Member Author
fzipi commented Dec 25, 2021

I'm still in doubt about the initial \r\n. What if it is in the end instead?

@fzipi fzipi mentioned this pull request Jan 2, 2022
Closed
@spartantri spartantri self-assigned this Jan 3, 2022
@fzipi
Copy link
Member Author
fzipi commented Feb 3, 2022

Hey @spartantri ! Did you take a look at this one?

@fzipi fzipi mentioned this pull request Feb 7, 2022
Closed
@theseion theseion self-requested a review February 7, 2022 19:52
@fzipi fzipi added this to the CRS v4.0 milestone Feb 7, 2022
@fzipi fzipi changed the title 2206 email ruleset Email ruleset Feb 7, 2022
@fzipi fzipi mentioned this pull request Mar 6, 2022
Closed
@franbuehler
Copy link
Contributor

Meeting decision March 7: merge this PR and continue the conversation about the LF/CR afterwards.

@lifeforms lifeforms merged commit a5baa8e into coreruleset:v3.4/dev Mar 7, 2022
@fzipi fzipi mentioned this pull request Apr 4, 2022
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@theseion theseion Awaiting requested review from theseion

Assignees

@spartantri spartantri

Labels
🏁 ready to merge 🚀 enhancement New feature or request
Projects
None yet
Milestone
CRS v4.0.0
Development

Successfully merging this pull request may close these issues.

New PL2/3 rule that catches mail (SMTP) injections
5 participants
@fzipi @dune73 @franbuehler @lifeforms @spartantri
0