CD< does not pass mod security filters about owasp-modsecurity-crs HOT 3 CLOSED

Original reporter: arrakami

from owasp-modsecurity-crs.

brectanus: I moved this over to Core Rules as this looks like id:950006.

What version of Core Rules is this?

It looks like it does not like "CD</" as the "<" is detected under the generic "\W*?" (non-word chars). Your modification seems reasonable as it makes the pattern more specific. However, a space is not required under Windows between "CD" and "/some/path", so maybe this is better (make spaces optional)?

d(?:\b\s_[.~\/]|\W_?..)

from owasp-modsecurity-crs.

rcbarnett: In the new CRS v2.0.0 rules, the rules use anomaly scoring/collaborative rules. So, while this particular payload does match, you are able to over-ride it later on and re-adjust the anomaly score. Here is an example where I sent the following request with the same payload that you sent -

--ba166a09-A--
[05/Aug/2009:18:23:13 --0400] SnoGUX8AAQEAABKJPy8AAACA 192.168.0.100 47476 192.168.0.100 80
--ba166a09-B--
GET /cgi-bin/test-cgi?foo=%3Cli%3ECD%20drive%20if%20installing%20from%20CD%3C/li%3E HTTP/1.1
Host: 192.168.0.100
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive

Here is the individual rule match from the modsec_audit.log file -

Message: Pattern match "\bcd\b\W*?[/]" at TX:pm_data_ARGS:foo. [file "/usr/local/apache/conf/modsecurity-core-rules/base_rules/modsecurity_crs_40_generic_attacks.conf"] [line "244"] [id "958821"] [msg "System Command Injection"] [data "cd</"] [severity "CRITICAL"] [tag "WEB_ATTACK/COMMAND_INJECTION"]

In order to implement an exclusion for this in the new CRS 2.0.0 format, you should add the following entry to the modsecurity_48_local_exceptions.conf file -

SecRule TX:PM_DATA_ARGS:foo "@Streq

This rule will inspect the TX variable data that matched from the audit log file to see if the exact false positive payload data is in the argument called foo. If so, then we will decrement the anomaly score by 20.

from owasp-modsecurity-crs.