Skip to content
This repository has been archived by the owner on May 14, 2020. It is now read-only.

Content-Type var fix ModSec v2 v3 900220 soap xml #1748

Merged
merged 5 commits into from
May 5, 2020
+46 −14
Merged

Content-Type var fix ModSec v2 v3 900220 soap xml #1748

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
cb58e3e
Resolve issue with allowed_request_content_types
franbuehler Apr 27, 2020
2e1eda8
Set var to lowercase and change comment
franbuehler Apr 28, 2020
71d6e0d
Change to preferred lowercase var
franbuehler Apr 28, 2020
8eab11b
Update nextcloud excl rules and shorten var
franbuehler Apr 28, 2020
1326250
Merge branch 'v3.3/dev' into 900200-soap-xml
franbuehler May 5, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions crs-setup.conf.example
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -388,17 +388,17 @@ SecDefaultAction "phase:2,log,auditlog,pass"
# setvar:'tx.allowed_methods=GET HEAD POST OPTIONS'"

# Content-Types that a client is allowed to send in a request.
# Default: application/x-www-form-urlencoded|multipart/form-data|multipart/related|\
# text/xml|application/xml|application/soap+xml|application/x-amf|application/json|\
# application/octet-stream|application/csp-report|application/xss-auditor-report|text/plain
# Default: |application/x-www-form-urlencoded| |multipart/form-data| |multipart/related|
# |text/xml| |application/xml| |application/soap+xml| |application/x-amf| |application/json|
# |application/octet-stream| |application/csp-report| |application/xss-auditor-report| |text/plain|
# Uncomment this rule to change the default.
#SecAction \
# "id:900220,\
# phase:1,\
# nolog,\
# pass,\
# t:none,\
# setvar:'tx.allowed_request_content_type=application/x-www-form-urlencoded|multipart/form-data|multipart/related|text/xml|application/xml|application/soap+xml|application/x-amf|application/json|application/octet-stream|application/csp-report|application/xss-auditor-report|text/plain'"
# setvar:'tx.allowed_request_content_type=|application/x-www-form-urlencoded| |multipart/form-data| |multipart/related| |text/xml| |application/xml| |application/soap+xml| |application/x-amf| |application/json| |application/octet-stream| |application/csp-report| |application/xss-auditor-report| |text/plain|'"

# Allowed HTTP versions.
# Default: HTTP/1.0 HTTP/1.1 HTTP/2 HTTP/2.0
Expand Down
2 changes: 1 addition & 1 deletion rules/REQUEST-901-INITIALIZATION.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -182,7 +182,7 @@ SecRule &TX:allowed_request_content_type "@eq 0" \
pass,\
nolog,\
ver:'OWASP_CRS/3.2.0',\
setvar:'tx.allowed_request_content_type=application/x-www-form-urlencoded|multipart/form-data|multipart/related|text/xml|application/xml|application/soap+xml|application/x-amf|application/json|application/octet-stream|application/csp-report|application/xss-auditor-report|text/plain'"
setvar:'tx.allowed_request_content_type=|application/x-www-form-urlencoded| |multipart/form-data| |multipart/related| |text/xml| |application/xml| |application/soap+xml| |application/x-amf| |application/json| |application/octet-stream| |application/csp-report| |application/xss-auditor-report| |text/plain|'"

# Default HTTP policy: allowed_request_content_type_charset (rule 900270)
SecRule &TX:allowed_request_content_type_charset "@eq 0" \
Expand Down
8 changes: 4 additions & 4 deletions rules/REQUEST-903.9003-NEXTCLOUD-EXCLUSION-RULES.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,7 +103,7 @@ SecRule REQUEST_FILENAME "@contains /remote.php/dav/files/" \
t:none,\
nolog,\
ver:'OWASP_CRS/3.2.0',\
setvar:'tx.allowed_request_content_type=%{tx.allowed_request_content_type}|text/vcard'"
setvar:'tx.allowed_request_content_type=%{tx.allowed_request_content_type} |text/vcard|'"

# Allow the data type 'application/octet-stream'

Expand All @@ -116,7 +116,7 @@ SecRule REQUEST_METHOD "@rx ^(?:PUT|MOVE)$" \
ver:'OWASP_CRS/3.2.0',\
chain"
SecRule REQUEST_FILENAME "@rx /remote\.php/dav/(?:files|uploads)/" \
"setvar:'tx.allowed_request_content_type=%{tx.allowed_request_content_type}|application/octet-stream'"
"setvar:'tx.allowed_request_content_type=%{tx.allowed_request_content_type} |application/octet-stream|'"

# Allow data types like video/mp4

Expand Down Expand Up @@ -290,7 +290,7 @@ SecRule REQUEST_FILENAME "@contains /remote.php/dav/addressbooks/" \
t:none,\
nolog,\
ver:'OWASP_CRS/3.2.0',\
setvar:'tx.allowed_request_content_type=%{tx.allowed_request_content_type}|text/vcard'"
setvar:'tx.allowed_request_content_type=%{tx.allowed_request_content_type} |text/vcard|'"

# Allow modifying contacts via the web interface
SecRule REQUEST_METHOD "@streq PUT" \
Expand All @@ -315,7 +315,7 @@ SecRule REQUEST_FILENAME "@contains /remote.php/dav/calendars/" \
t:none,\
nolog,\
ver:'OWASP_CRS/3.2.0',\
setvar:'tx.allowed_request_content_type=%{tx.allowed_request_content_type}|text/calendar'"
setvar:'tx.allowed_request_content_type=%{tx.allowed_request_content_type} |text/calendar|'"


# [ Notes ]
Expand Down
7 changes: 3 additions & 4 deletions rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -964,11 +964,10 @@ SecRule REQUEST_HEADERS:Content-Type "@rx ^[^;\s]+" \
tag:'PCI/12.1',\
ver:'OWASP_CRS/3.2.0',\
severity:'CRITICAL',\
setvar:'tx.content_type=|%{tx.0}|',\
chain"
SecRule TX:0 "!@rx ^%{tx.allowed_request_content_type}$" \
"t:none,\
ctl:forceRequestBodyVariable=On,\
setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
SecRule TX:content_type "!@within %{tx.allowed_request_content_type}" \
"setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'"


#
Expand Down
35 changes: 34 additions & 1 deletion tests/regression/tests/REQUEST-920-PROTOCOL-ENFORCEMENT/920420.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---
meta:
author: "csanders-git"
author: "csanders-git, Franziska Bühler"
enabled: true
name: "920420.yaml"
description: "Description"
Expand Down Expand Up @@ -218,4 +218,37 @@
data: "test"
output:
no_log_contains: "id \"920420\""
-
test_title: 920420-10
stages:
-
stage:
input:
dest_addr: "127.0.0.1"
port: 80
method: "OPTIONS"
headers:
User-Agent: "ModSecurity CRS 3 Tests"
Host: "localhost"
Content-Type: "application/soap+xml"
data: "test"
output:
no_log_contains: "id \"920420\""
-
test_title: 920420-11
stages:
-
stage:
input:
dest_addr: "127.0.0.1"
port: 80
method: "OPTIONS"
headers:
User-Agent: "ModSecurity CRS 3 Tests"
Host: "localhost"
Content-Type: "application"
data: "test"
output:
log_contains: "id \"920420\""