nginx - 在 ModSecurity 规则中添加例外 (SecRuleUpdateTargetById) 不起作用?
问题描述
我已经在 nginx 中安装了 ModSecurity,并在本文档的帮助下安装了 OWASP CRS 。
一切正常,除了其中一条规则是拒绝有效请求。我收到 403 Access Denied 错误。原因似乎是我的 URL 参数或请求正文中有一个键名imagebase64。
此规则文件导致我的访问被拒绝问题。这是规则:
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|ARGS_NAMES|ARGS|XML:/* "@rx (?i)[\s\S](?:x(?:link:href|html|mlns)|!ENTITY.*?SYSTEM|data:text\/html|pattern(?=.*?=)|formaction|\@import|base64)\b" \
"id:941130,\
phase:2,\
block,\
capture,\
t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\
msg:'XSS Filter - Category 3: Attribute Vector',\
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
tag:'application-multi',\
tag:'language-multi',\
tag:'platform-multi',\
tag:'attack-xss',\
tag:'OWASP_CRS/WEB_ATTACK/XSS',\
tag:'WASCTC/WASC-8',\
tag:'WASCTC/WASC-22',\
tag:'OWASP_TOP_10/A3',\
tag:'OWASP_AppSensor/IE1',\
tag:'CAPEC-242',\
ctl:auditLogParts=+E,\
ver:'OWASP_CRS/3.1.0',\
severity:'CRITICAL',\
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
我们可以看到下面的正则表达式匹配以base64结尾的字符串。所以请求正文中的 key imagebase64匹配,请求被拒绝。
(?i)[\s\S](?:x(?:link:href|html|mlns)|!ENTITY.*?SYSTEM|data:text\/html|pattern(?=.*?=)|formaction|\@import|base64)
这是日志(我已经更改了实际的端点、令牌等,保持生成的日志不变):
---kmzyGTME---H--
ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)[\s\S](?:x(?:link:href|html|mlns)|!ENTITY.*?SYSTEM|data:text\/html|pattern(?=.*?=)|formaction|\@import|base64)\b' against variable `ARGS_NAMES:json.some.randomStuff.randomList.array_0.imageBase64' (Value: `json.some.randomStuff.randomList.array_0.imageBase64' ) [file "/usr/local/owasp-modsecurity-crs-3.0.2/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "139"] [id "941130"] [rev "2"] [msg "XSS Filter - Category 3: Attribute Vector"] [data "Matched Data: eBase64 found within ARGS_NAMES:json.some.randomStuff.randomList.array_0.imageBase64: json.some.randomStuff.randomList.array_0.imageBase64"] [severity "2"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "OWASP_CRS/WEB_ATTACK/XSS"] [tag "WASCTC/WASC-8"] [tag "WASCTC/WASC-22"] [tag "OWASP_TOP_10/A3"] [tag "OWASP_AppSensor/IE1"] [tag "CAPEC-242"] [hostname "00.00.2.1"] [uri "/some/fake/endpoint"] [unique_id "83423785723453523523.234324234"] [ref "o47,7v0,54t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:ANOMALY_SCORE' (Value: `5' ) [file "/usr/local/owasp-modsecurity-crs-3.0.2/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "44"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "2"] [ver ""] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "00.00.0.0"] [uri "/some/fake/endpoint"] [unique_id "156150510827.687874"] [ref ""]
ModSecurity: Warning. Matched "Operator `Ge' with parameter `5' against variable `TX:INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/usr/local/owasp-modsecurity-crs-3.0.2/rules/RESPONSE-980-CORRELATION.conf"] [line "65"] [id "980130"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): XSS Filter - Category 3: Attribute Vector"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [tag "event-correlation"] [hostname "00.00.0.0"] [uri "/some/fake/endpoint"] [unique_id "238472356327653256235.2352353"] [ref ""]
我尝试通过在规则文件中添加以下行来将imagebase64添加为异常键:
SecRuleUpdateTargetById 941130 !ARGS_NAMES:imagebase64
我参考了这本参考手册。它对我不起作用。
但是,直接使用在正则表达式中添加异常是可行的(?<!imagebase64)
。
我究竟做错了什么?如何修改规则以仅接受imagebase64
作为密钥?
解决方案
错误日志条目有这个片段:
data "Matched Data: eBase64 found within ARGS_NAMES:json.some.randomStuff.randomList.array_0.imageBase64
所以参数名称不是imageBase64
但是json.some.randomStuff.randomList.array_0.imageBase64
您需要包含完整的参数名称,或与其匹配的正则表达式。
推荐阅读
- cmd - 在 CMD 中连接目录和子目录中的所有文件
- javascript - register:141 Uncaught SyntaxError: missing ) 在参数列表之后
- php - Laravel 雄辩的两个关系之间的关系
- javascript - 在javascript中按其项目的属性过滤列表
- hadoop - Hadoop:哪个映射器返回了哪个结果?
- apache-kafka - 添加 Kafka 服务失败
- elasticsearch - 在 Kibana 的 watcher 中放置要搜索的字符串的位置
- r - 如何避免 R 在 svg 中生成巨大的字体
- python - 在 with 语句后用作对象时是否有任何潜在的漏洞?
- visual-studio - 如何安装“Visual Studio 的单声道调试”?