NextCloud False Positive about owasp-modsecurity-crs HOT 9 OPEN

Hi @manuelroccon. Did you enable NextCloud exclusion rules in rule id:900130 in crs-setup.conf?

from owasp-modsecurity-crs.

@manuelroccon Any comments so we can figure this out?

from owasp-modsecurity-crs.

I use secremovebyid in apache vhost configuration. This is right method to fix this issue?

from owasp-modsecurity-crs.

Depends.

You need to first enable the exclusion rules for NextCloud. Can you please check the file crs-setup.conf, and search for 900130?

Then you need to have something like this:

SecAction \
 "id:900130,\
  phase:1,\
  nolog,\
  pass,\
  t:none,\
  setvar:tx.crs_exclusions_nextcloud=1"

That will effectively enable the exclusions we have for NextCloud. Without that, the rules to prevent this are not enabled!

from owasp-modsecurity-crs.

@manuelroccon Can you check this please? ☝️

from owasp-modsecurity-crs.

ok, this exclusion rules not enabled in crs-setup.conf.
But if i've more vhosts in my server with different CMS, can I put this exclusion directive only in vhost configuration that running Nextcloud?

from owasp-modsecurity-crs.

@manuelroccon You can also do this:

# It is recommended if you run multiple web applications on your site to limit
# the effects of the exclusion to only the path where the excluded webapp
# resides using a rule similar to the following example:
# SecRule REQUEST_URI "@beginsWith /wordpress/" setvar:tx.crs_exclusions_wordpress=1

Give a quick look at the whole crs-setup.conf file to get a taste what you can do.

from owasp-modsecurity-crs.

@fzipi thank for your support,

The crs-setup.conf are default, i've not modify it of master brench.

I've read this recommendation about REQUEST_URI "@beginswith /wordpress/" in crs-setup.conf, but REQUEST_URI of vhosts not start with specific pattern.
All vhosts are separate domain. If i make this exclusion in crs-setup.conf is applied to all sites inside server.

So I think i must put this directive (SecAction "id:900130,) directly inside the apache vhost config, to apply this only specific vhost (in this case in nextcloud).

Is fine this tipe of configuration for you or there are other solutions?

from owasp-modsecurity-crs.

Hi @manuelroccon,

Hmmm.. 🤔 you will definitely need to apply this to a particular url/vhost. One technique I normally use in these cases is to use the SecWebAppId directive.

For example (you may need to modify it a bit, it is just a rough idea),

<VirtualHost Z.Z.Z.Z:44>
    SecWebAppId  my-nextcloud
...
...
</VirtualHost>

# And then:
SecRule WEBAPPID "@eq my-nextcloud" "setvar:tx.crs_exclusions_wordpress=1"

Please check the documentation for more examples.

from owasp-modsecurity-crs.