Search code examples
nginxowaspmod-security

Adding exceptions (SecRuleUpdateTargetById) in ModSecurity rule does not work?

I have installed ModSecurity in nginx and install OWASP CRS with the help of this documentation.

Everything works fine except, one of the rules is denying a valid request. I am getting 403 Access Denied error. The reason seems to be that I have a key name imagebase64 in my URL parameter or request body.

This rule file is causing the Access Denied issue for me. Here is the rule:

SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|ARGS_NAMES|ARGS|XML:/* "@rx (?i)[\s\S](?:x(?:link:href|html|mlns)|!ENTITY.*?SYSTEM|data:text\/html|pattern(?=.*?=)|formaction|\@import|base64)\b" \
    "id:941130,\
    phase:2,\
    block,\
    capture,\
    t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\
    msg:'XSS Filter - Category 3: Attribute Vector',\
    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
    tag:'application-multi',\
    tag:'language-multi',\
    tag:'platform-multi',\
    tag:'attack-xss',\
    tag:'OWASP_CRS/WEB_ATTACK/XSS',\
    tag:'WASCTC/WASC-8',\
    tag:'WASCTC/WASC-22',\
    tag:'OWASP_TOP_10/A3',\
    tag:'OWASP_AppSensor/IE1',\
    tag:'CAPEC-242',\
    ctl:auditLogParts=+E,\
    ver:'OWASP_CRS/3.1.0',\
    severity:'CRITICAL',\
    setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
    setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'"

As we can see the regular expression below matches string which end with base64. So the key imagebase64 in request body is matched and the request is denied.
(?i)[\s\S](?:x(?:link:href|html|mlns)|!ENTITY.*?SYSTEM|data:text\/html|pattern(?=.*?=)|formaction|\@import|base64)

Here are the logs(I have changed the actual Endpoints, tokens etc keeping the generated logs untouched):


---kmzyGTME---H--
ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)[\s\S](?:x(?:link:href|html|mlns)|!ENTITY.*?SYSTEM|data:text\/html|pattern(?=.*?=)|formaction|\@import|base64)\b' against variable `ARGS_NAMES:json.some.randomStuff.randomList.array_0.imageBase64' (Value: `json.some.randomStuff.randomList.array_0.imageBase64' ) [file "/usr/local/owasp-modsecurity-crs-3.0.2/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "139"] [id "941130"] [rev "2"] [msg "XSS Filter - Category 3: Attribute Vector"] [data "Matched Data: eBase64 found within ARGS_NAMES:json.some.randomStuff.randomList.array_0.imageBase64: json.some.randomStuff.randomList.array_0.imageBase64"] [severity "2"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "OWASP_CRS/WEB_ATTACK/XSS"] [tag "WASCTC/WASC-8"] [tag "WASCTC/WASC-22"] [tag "OWASP_TOP_10/A3"] [tag "OWASP_AppSensor/IE1"] [tag "CAPEC-242"] [hostname "00.00.2.1"] [uri "/some/fake/endpoint"] [unique_id "83423785723453523523.234324234"] [ref "o47,7v0,54t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:ANOMALY_SCORE' (Value: `5' ) [file "/usr/local/owasp-modsecurity-crs-3.0.2/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "44"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "2"] [ver ""] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "00.00.0.0"] [uri "/some/fake/endpoint"] [unique_id "156150510827.687874"] [ref ""]
ModSecurity: Warning. Matched "Operator `Ge' with parameter `5' against variable `TX:INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/usr/local/owasp-modsecurity-crs-3.0.2/rules/RESPONSE-980-CORRELATION.conf"] [line "65"] [id "980130"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): XSS Filter - Category 3: Attribute Vector"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [tag "event-correlation"] [hostname "00.00.0.0"] [uri "/some/fake/endpoint"] [unique_id "238472356327653256235.2352353"] [ref ""]

I tried adding imagebase64 as an exceptional key by adding the below line in the rule file:

SecRuleUpdateTargetById 941130 !ARGS_NAMES:imagebase64

I referred to this reference manual. It doesn't work for me.

However, adding an exception in regular expression directly using (?<!imagebase64) works.

What am I doing wrong? How do I modify the rule to only accept imagebase64 as a key?

Solution

  • The error log entry has this snippet:

    data "Matched Data: eBase64 found within ARGS_NAMES:json.some.randomStuff.randomList.array_0.imageBase64

    So the argument name is not imageBase64 but json.some.randomStuff.randomList.array_0.imageBase64

    You need to include the full argument name, or a regex that matches to it.