{"action":"created","issue":{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/402","repository_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs","labels_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/402/labels{/name}","comments_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/402/comments","events_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/402/events","html_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/402","id":165134166,"number":402,"title":"Inspect Referer, User-Agent headers for SQLi, XSS","user":{"login":"lifeforms","id":3464056,"avatar_url":"https://avatars.githubusercontent.com/u/3464056?v=3","gravatar_id":"","url":"https://api.github.com/users/lifeforms","html_url":"https://github.com/lifeforms","followers_url":"https://api.github.com/users/lifeforms/followers","following_url":"https://api.github.com/users/lifeforms/following{/other_user}","gists_url":"https://api.github.com/users/lifeforms/gists{/gist_id}","starred_url":"https://api.github.com/users/lifeforms/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lifeforms/subscriptions","organizations_url":"https://api.github.com/users/lifeforms/orgs","repos_url":"https://api.github.com/users/lifeforms/repos","events_url":"https://api.github.com/users/lifeforms/events{/privacy}","received_events_url":"https://api.github.com/users/lifeforms/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/labels/Beyond%20V3.0.0","name":"Beyond V3.0.0","color":"fbcdbf"},{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/labels/Feature%20Request","name":"Feature Request","color":"efb480"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/milestones/3","html_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs/milestones/CRS%20v3.0.0%20RC1","labels_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/milestones/3/labels","id":458025,"number":3,"title":"CRS v3.0.0 RC1","description":"","creator":{"login":"rcbarnett","id":621352,"avatar_url":"https://avatars.githubusercontent.com/u/621352?v=3","gravatar_id":"","url":"https://api.github.com/users/rcbarnett","html_url":"https://github.com/rcbarnett","followers_url":"https://api.github.com/users/rcbarnett/followers","following_url":"https://api.github.com/users/rcbarnett/following{/other_user}","gists_url":"https://api.github.com/users/rcbarnett/gists{/gist_id}","starred_url":"https://api.github.com/users/rcbarnett/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rcbarnett/subscriptions","organizations_url":"https://api.github.com/users/rcbarnett/orgs","repos_url":"https://api.github.com/users/rcbarnett/repos","events_url":"https://api.github.com/users/rcbarnett/events{/privacy}","received_events_url":"https://api.github.com/users/rcbarnett/received_events","type":"User","site_admin":false},"open_issues":20,"closed_issues":106,"state":"open","created_at":"2013-10-17T21:30:28Z","updated_at":"2016-08-02T20:13:29Z","due_on":"2016-07-31T04:00:00Z","closed_at":null},"comments":2,"created_at":"2016-07-12T17:27:53Z","updated_at":"2016-08-02T20:38:44Z","closed_at":null,"body":"Regularly an application turns up which is vulnerable to exploits in some request headers. Today it was [another popular WordPress plugin](https://www.wordfence.com/blog/2016/07/xss-vulnerability-all-in-one-seo-pack-plugin/).\r\n\r\nThe thing about referrers and user-agent strings is that they often turn up in logging interfaces. These log viewers are notorious for bad escaping and stored XSS.\r\n\r\nI'm somewhat less bullish on SQL injections via User-Agent, but Google is full of results when searching for it, so I'd say let's check those too while we're editing this.\r\n\r\nI also note that `ARGS_NAMES` is not checked with detectSQLi in rule 942100, so I think this will miss bare post data.\r\n\r\nIn short, I feel we should:\r\n\r\n- check `REQUEST_HEADERS:User-Agent` \r\n- check `REQUEST_HEADERS:Referer` \r\n- check `ARGS_NAMES`\r\n\r\nfor the SQLi and XSS rules in 941xxx and 942xxx."},"comment":{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/comments/237035906","html_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/402#issuecomment-237035906","issue_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/402","id":237035906,"user":{"login":"lifeforms","id":3464056,"avatar_url":"https://avatars.githubusercontent.com/u/3464056?v=3","gravatar_id":"","url":"https://api.github.com/users/lifeforms","html_url":"https://github.com/lifeforms","followers_url":"https://api.github.com/users/lifeforms/followers","following_url":"https://api.github.com/users/lifeforms/following{/other_user}","gists_url":"https://api.github.com/users/lifeforms/gists{/gist_id}","starred_url":"https://api.github.com/users/lifeforms/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lifeforms/subscriptions","organizations_url":"https://api.github.com/users/lifeforms/orgs","repos_url":"https://api.github.com/users/lifeforms/repos","events_url":"https://api.github.com/users/lifeforms/events{/privacy}","received_events_url":"https://api.github.com/users/lifeforms/received_events","type":"User","site_admin":false},"created_at":"2016-08-02T20:38:44Z","updated_at":"2016-08-02T20:38:44Z","body":"`ARGS_NAMES` was added to detectSQLi in #417.\r\n\r\nFor 3.0 I'll create a PR to add `REQUEST_HEADERS:User-Agent` and `REQUEST_HEADERS:Referer` to libinjection rules only. This should hopefully at least catch some payloads while keeping the amount of work reasonable.\r\n\r\nFor 3.1 we can consider checking those headers in (much) more rules, after experience."}}
{"actor":{"display_login":"lifeforms"}}