{"action":"created","issue":{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/369","repository_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs","labels_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/369/labels{/name}","comments_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/369/comments","events_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/369/events","html_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/369","id":161041491,"number":369,"title":"Add base64 decoding for some rules","user":{"login":"lifeforms","id":3464056,"avatar_url":"https://avatars.githubusercontent.com/u/3464056?v=3","gravatar_id":"","url":"https://api.github.com/users/lifeforms","html_url":"https://github.com/lifeforms","followers_url":"https://api.github.com/users/lifeforms/followers","following_url":"https://api.github.com/users/lifeforms/following{/other_user}","gists_url":"https://api.github.com/users/lifeforms/gists{/gist_id}","starred_url":"https://api.github.com/users/lifeforms/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lifeforms/subscriptions","organizations_url":"https://api.github.com/users/lifeforms/orgs","repos_url":"https://api.github.com/users/lifeforms/repos","events_url":"https://api.github.com/users/lifeforms/events{/privacy}","received_events_url":"https://api.github.com/users/lifeforms/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/labels/Feature%20Request","name":"Feature Request","color":"efb480"},{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/labels/v3.1.0-rc1%20Candidate%20Issue","name":"v3.1.0-rc1 Candidate Issue","color":"fbcdbf"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2016-06-18T20:15:42Z","updated_at":"2016-08-05T09:59:00Z","closed_at":null,"body":"Some vulnerabilities are being exploited using base64-encoded payloads, as suggested in #353.\r\n\r\n- [ ] rule 933170 ([example vulnerability](https://github.com/SimpleMachines/SMF2.1/blob/404fd5347951652624dfb72304ee38fcab98378f/Sources/Packages.php#L863-L873))\r\n- [ ] rule 933140 (found in logs)\r\n- [ ] LFI + path traversal rules (I recall some WordPress plugin that allowed arbitrary LFI via base64-encoded path, I have an in-house rule for this)\r\n- [ ] review if this is interesting for other rules as well (grep logs)\r\n\r\nConsider if we can use transformation operators with multimatch in the existing rule, or if we should make siblings.\r\n\r\nThere may be performance problems associated with this transformation, so test carefully the performance impact. If this is significant, we are better off adding these as siblings, for example in paranoia level 2."},"comment":{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/comments/237811854","html_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/369#issuecomment-237811854","issue_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/369","id":237811854,"user":{"login":"lifeforms","id":3464056,"avatar_url":"https://avatars.githubusercontent.com/u/3464056?v=3","gravatar_id":"","url":"https://api.github.com/users/lifeforms","html_url":"https://github.com/lifeforms","followers_url":"https://api.github.com/users/lifeforms/followers","following_url":"https://api.github.com/users/lifeforms/following{/other_user}","gists_url":"https://api.github.com/users/lifeforms/gists{/gist_id}","starred_url":"https://api.github.com/users/lifeforms/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lifeforms/subscriptions","organizations_url":"https://api.github.com/users/lifeforms/orgs","repos_url":"https://api.github.com/users/lifeforms/repos","events_url":"https://api.github.com/users/lifeforms/events{/privacy}","received_events_url":"https://api.github.com/users/lifeforms/received_events","type":"User","site_admin":false},"created_at":"2016-08-05T09:59:00Z","updated_at":"2016-08-05T09:59:00Z","body":"Found these ones today:\r\n\r\n```\r\narray=ZXZhbCgnZWNobyAoMTIzNDU0MzIwKzEpO2V4aXQoKTsnKTs\r\nz=ZXZhbCgnZWNobyAoMTIzNDU0MzIwKzEpO2V4aXQoKTsnKTs\r\n```\r\n\r\nThis is base64-encoded `eval('echo (123454320+1);exit();'` which is now caught by 933150."}}
{"actor":{"display_login":"lifeforms"}}