8000 fix(933120): do not match on base64 encoded strings by fzipi · Pull Request #3863 · coreruleset/coreruleset · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

fix(933120): do not match on base64 encoded strings #3863

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Oct 16, 2024
Merged

fix(933120): do not match on base64 encoded strings #3863

merged 2 commits into from
Oct 16, 2024

Conversation

fzipi
Copy link
Member
@fzipi fzipi commented Oct 16, 2024 •
edited
Loading

what

  • rule should match on PHP configuration modification attacks
  • uses pmfromfile to match config names
  • then there should be an equal sign, and the value to modify

👉 modify the rule to have a value after the equal sign, so it is relevant to what we try to match.

why

  • rule is matching on base64 encoded strings with double equal signs

Fixes #3723

fzipi and others added 2 commits October 16, 2024 09:18
@fzipi fzipi requested a review from a team October 16, 2024 12:22
airween
airween approved these changes Oct 16, 2024
View reviewed changes
Copy link
Contributor
@airween airween left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@fzipi fzipi added this pull request to the merge queue Oct 16, 2024
Merged via the queue into main with commit e84a780 Oct 16, 2024
7 checks passed
@fzipi fzipi deleted the fix/3723 branch October 16, 2024 12:43
@fzipi fzipi mentioned this pull request Oct 16, 2024
Closed
@EsadCetiner EsadCetiner mentioned this pull request Oct 20, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@airween airween airween approved these changes

Assignees
No one assigned
Labels
release:fix
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Rule 933120 FP on various SAML software products
2 participants
@fzipi @airween
0