Question

我已经在nginx中安装了ModSecurity，并借助此documentation安装了OWASP CRS。

一切正常，但其中一项规则是拒绝有效请求。我收到“ 403访问被拒绝”错误。原因似乎是我的URL参数或请求正文中有一个键名 imagebase64 。

此rule file对我造成了访问被拒绝的问题。这是规则：

SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|ARGS_NAMES|ARGS|XML:/* "@rx (?i)[\s\S](?:x(?:link:href|html|mlns)|!ENTITY.*?SYSTEM|data:text\/html|pattern(?=.*?=)|formaction|\@import|base64)\b" \
    "id:941130,\
    phase:2,\
    block,\
    capture,\
    t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\
    msg:'XSS Filter - Category 3: Attribute Vector',\
    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
    tag:'application-multi',\
    tag:'language-multi',\
    tag:'platform-multi',\
    tag:'attack-xss',\
    tag:'OWASP_CRS/WEB_ATTACK/XSS',\
    tag:'WASCTC/WASC-8',\
    tag:'WASCTC/WASC-22',\
    tag:'OWASP_TOP_10/A3',\
    tag:'OWASP_AppSensor/IE1',\
    tag:'CAPEC-242',\
    ctl:auditLogParts=+E,\
    ver:'OWASP_CRS/3.1.0',\
    severity:'CRITICAL',\
    setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
    setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'"

以下是日志（我已更改了实际的端点，令牌等，使生成的日志保持不变）：


---kmzyGTME---H--
ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)[\s\S](?:x(?:link:href|html|mlns)|!ENTITY.*?SYSTEM|data:text\/html|pattern(?=.*?=)|formaction|\@import|base64)\b' against variable `ARGS_NAMES:json.some.randomStuff.randomList.array_0.imageBase64' (Value: `json.some.randomStuff.randomList.array_0.imageBase64' ) [file "/usr/local/owasp-modsecurity-crs-3.0.2/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "139"] [id "941130"] [rev "2"] [msg "XSS Filter - Category 3: Attribute Vector"] [data "Matched Data: eBase64 found within ARGS_NAMES:json.some.randomStuff.randomList.array_0.imageBase64: json.some.randomStuff.randomList.array_0.imageBase64"] [severity "2"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "OWASP_CRS/WEB_ATTACK/XSS"] [tag "WASCTC/WASC-8"] [tag "WASCTC/WASC-22"] [tag "OWASP_TOP_10/A3"] [tag "OWASP_AppSensor/IE1"] [tag "CAPEC-242"] [hostname "00.00.2.1"] [uri "/some/fake/endpoint"] [unique_id "83423785723453523523.234324234"] [ref "o47,7v0,54t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:ANOMALY_SCORE' (Value: `5' ) [file "/usr/local/owasp-modsecurity-crs-3.0.2/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "44"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "2"] [ver ""] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "00.00.0.0"] [uri "/some/fake/endpoint"] [unique_id "156150510827.687874"] [ref ""]
ModSecurity: Warning. Matched "Operator `Ge' with parameter `5' against variable `TX:INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/usr/local/owasp-modsecurity-crs-3.0.2/rules/RESPONSE-980-CORRELATION.conf"] [line "65"] [id "980130"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): XSS Filter - Category 3: Attribute Vector"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [tag "event-correlation"] [hostname "00.00.0.0"] [uri "/some/fake/endpoint"] [unique_id "238472356327653256235.2352353"] [ref ""]

我尝试通过在规则文件中添加以下行来添加 imagebase64 作为特殊键：

SecRuleUpdateTargetById 941130 !ARGS_NAMES:imagebase64

我参考了this参考手册。这对我不起作用。

但是，可以直接使用(?<!imagebase64)在正则表达式中添加异常。

我在做什么错？如何修改规则以仅接受imagebase64作为密钥？

Answer 1

错误日志条目包含以下代码段：

data "Matched Data: eBase64 found within ARGS_NAMES:json.some.randomStuff.randomList.array_0.imageBase64

因此参数名称不是imageBase64而是json.some.randomStuff.randomList.array_0.imageBase64

您需要包括完整的参数名称或与其匹配的正则表达式。

在ModSecurity规则中添加例外（SecRuleUpdateTargetById）不起作用？

1 个答案: