{"action":"created","issue":{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/236","repository_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs","labels_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/236/labels{/name}","comments_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/236/comments","events_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/236/events","html_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/236","id":93063042,"number":236,"title":"False positive with SMF Forum System","user":{"login":"WHK102","id":2144779,"avatar_url":"https://avatars.githubusercontent.com/u/2144779?v=3","gravatar_id":"","url":"https://api.github.com/users/WHK102","html_url":"https://github.com/WHK102","followers_url":"https://api.github.com/users/WHK102/followers","following_url":"https://api.github.com/users/WHK102/following{/other_user}","gists_url":"https://api.github.com/users/WHK102/gists{/gist_id}","starred_url":"https://api.github.com/users/WHK102/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/WHK102/subscriptions","organizations_url":"https://api.github.com/users/WHK102/orgs","repos_url":"https://api.github.com/users/WHK102/repos","events_url":"https://api.github.com/users/WHK102/events{/privacy}","received_events_url":"https://api.github.com/users/WHK102/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-07-05T00:56:47Z","updated_at":"2016-03-04T12:42:21Z","closed_at":null,"body":"SMF (simplemachines.org) use serialized cookies and launch alert in mod security:\r\n\r\n[Sat Jul 04 20:52:15 2015] [error] [client 192.168.1.39] ModSecurity: Access denied with code 403 (phase 2). Pattern match \"([\\\\\\\\~\\\\\\\\!\\\\\\\\@\\\\\\\\#\\\\\\\\$\\\\\\\\%\\\\\\\\^\\\\\\\\&\\\\\\\\*\\\\\\\\(\\\\\\\\)\\\\\\\\-\\\\\\\\+\\\\\\\\=\\\\\\\\{\\\\\\\\}\\\\\\\\[\\\\\\\\]\\\\\\\\|\\\\\\\\:\\\\\\\\;\\\\\"\\\\\\\\'\\\\\\\\\\\\xc2\\\\xb4\\\\\\\\\\\\xe2\\\\x80\\\\x99\\\\\\\\\\\\xe2\\\\x80\\\\x98\\\\\\\\`\\\\\\\\<\\\\\\\\>].*?){8,}\" at REQUEST_COOKIES:smf_session_data. [file \"/etc/httpd/conf/crs/activated_rules/modsecurity_crs_41_sql_injection_attacks.conf\"] [line \"157\"] [id \"981172\"] [rev \"2\"] [msg \"Restricted SQL Character Anomaly Detection Alert - Total # of special characters exceeded\"] [data \"Matched Data: \\\\x22 found within REQUEST_COOKIES:smf_session_data: a:4:{i:0;s:1:\\\\x221\\\\x22;i:1;s:40:\\\\x22aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\\\\x22;i:2;i:1000000000;i:3;i:2;}\"] [ver \"OWASP_CRS/2.2.9\"] [maturity \"9\"] [accuracy \"8\"] [tag \"OWASP_CRS/WEB_ATTACK/SQL_INJECTION\"] [hostname \"test.com\"] [uri \"/index.php\"] [unique_id \"VZh-v38AAAEAAAd-BO8AAAAC\"]\r\n"},"comment":{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/comments/192265424","html_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/236#issuecomment-192265424","issue_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/236","id":192265424,"user":{"login":"dune73","id":618722,"avatar_url":"https://avatars.githubusercontent.com/u/618722?v=3","gravatar_id":"","url":"https://api.github.com/users/dune73","html_url":"https://github.com/dune73","followers_url":"https://api.github.com/users/dune73/followers","following_url":"https://api.github.com/users/dune73/following{/other_user}","gists_url":"https://api.github.com/users/dune73/gists{/gist_id}","starred_url":"https://api.github.com/users/dune73/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dune73/subscriptions","organizations_url":"https://api.github.com/users/dune73/orgs","repos_url":"https://api.github.com/users/dune73/repos","events_url":"https://api.github.com/users/dune73/events{/privacy}","received_events_url":"https://api.github.com/users/dune73/received_events","type":"User","site_admin":false},"created_at":"2016-03-04T12:42:21Z","updated_at":"2016-03-04T12:42:21Z","body":"Sorry for taking so long to address this.\r\n\r\nThis is a typical false positive which comes with the use of the CRS. You can suppress it easily with the following tuning rule:\r\n\r\n    SecRuleUpdateTargetById 981172 \"!REQUEST_COOKIES:smf_session_data\"  \r\n\r\nPlease note that this tuning rule is meant to go into your config file _after_ the CRS inclusion statement. Please do not edit your CRS files, Keep your edits out of these files, so you can later replace the CRS files more easily.\r\n\r\nI am going to close this now.\r\n"}}