{"action":"created","issue":{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/199","repository_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs","labels_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/199/labels{/name}","comments_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/199/comments","events_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/199/events","html_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/199","id":46679566,"number":199,"title":"quotes in uploaded filenames","user":{"login":"quenenni","id":3638408,"avatar_url":"https://avatars.githubusercontent.com/u/3638408?v=3","gravatar_id":"","url":"https://api.github.com/users/quenenni","html_url":"https://github.com/quenenni","followers_url":"https://api.github.com/users/quenenni/followers","following_url":"https://api.github.com/users/quenenni/following{/other_user}","gists_url":"https://api.github.com/users/quenenni/gists{/gist_id}","starred_url":"https://api.github.com/users/quenenni/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/quenenni/subscriptions","organizations_url":"https://api.github.com/users/quenenni/orgs","repos_url":"https://api.github.com/users/quenenni/repos","events_url":"https://api.github.com/users/quenenni/events{/privacy}","received_events_url":"https://api.github.com/users/quenenni/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":12,"created_at":"2014-10-23T21:28:58Z","updated_at":"2016-12-01T13:46:41Z","closed_at":"2016-06-16T08:42:08Z","body":"Hello,\n\nIt appears modsec doesn't like filenames with single quotes in them.\n\nI have that error:\n\n```\n[Mon Oct 20 16:00:48 2014] [error] [client xxx.xxx.xxx.xxx] ModSecurity: Access denied with code 44 (phase 2). Match of \"eq 0\" against \"MULTIPART_STRICT_ERROR\" required. [file \"/etc/modsecurity/modsecurity.conf\"] [line \"81\"] [msg \"Multipart request body failed strict validation: PE 0, BQ 0, BW 0, DB 0, DA 0, HF 0, LF 0, SM , IQ 1, IQ 0, IH 0, IH 0\"] [hostname \"www.xxx.be\"] [uri \"/ecrire/\"] [unique_id \"VEUVf09jyzIAAAbkFlcAAABI\"]\n```\n\nThe 'IQ 1'  is the \"%{MULTIPART_INVALID_QUOTING}\" var that was set to 1 and thus triggered the MULTIPART_STRICT_ERROR rule.\n\nUnfortunately, single quotes  are often used in french.\n\nAfter digging on the net, I noticed people complain about false positives with this rule (MULTIPART_STRICT_ERROR) and the suggestions are to not block anymore but just log these transactions.\n\nI would like to just remove the \"MULTIPART_INVALID_QUOTING\" test (that increments the \"MULTIPART_STRICT_ERROR\") in order to keep the other tests active.\n\nBut I couldn't find where these tests are (/etc/modsecurity  /usr/share/modsecurity-crs/) or how I could update the rule to achieve what I want... or even if it's something that can be done.\n\nAny idea how I can do that?\nThanks.\n\nAnother thing:\nThe rule \"SecRule MULTIPART_STRICT_ERROR \"!@eq 0\"  can be found in 2 separate files and I have the impression it's not on purpose:\n\n1 - /etc/modsecurity/modsecurity.conf (line 67)\n\n```\nSecRule MULTIPART_STRICT_ERROR \"!@eq 0\" \\\n\"phase:2,t:none,log,deny,status:44,msg:'Multipart request body \\\nfailed strict validation: \\\nPE %{REQBODY_PROCESSOR_ERROR}, \\\nBQ %{MULTIPART_BOUNDARY_QUOTED}, \\\nBW %{MULTIPART_BOUNDARY_WHITESPACE}, \\\nDB %{MULTIPART_DATA_BEFORE}, \\\nDA %{MULTIPART_DATA_AFTER}, \\\nHF %{MULTIPART_HEADER_FOLDING}, \\\nLF %{MULTIPART_LF_LINE}, \\\nSM %{MULTIPART_SEMICOLON_MISSING}, \\\nIQ %{MULTIPART_INVALID_QUOTING}, \\\nIQ %{MULTIPART_INVALID_PART}, \\\nIH %{MULTIPART_INVALID_HEADER_FOLDING}, \\\nIH %{MULTIPART_FILE_LIMIT_EXCEEDED}'\"\n```\n\n2 - /usr/share/modsecurity-crs/base_rules/modsecurity_crs_20_protocol_violations.conf (line 106)\n\n```\nSecRule MULTIPART_STRICT_ERROR \"!@eq 0\" \\\n        \"phase:2,t:none,block,msg:'Multipart request body failed strict validation: \\\nPE %{REQBODY_PROCESSOR_ERROR}, \\\nBQ %{MULTIPART_BOUNDARY_QUOTED}, \\\nBW %{MULTIPART_BOUNDARY_WHITESPACE}, \\\nDB %{MULTIPART_DATA_BEFORE}, \\\nDA %{MULTIPART_DATA_AFTER}, \\\nHF %{MULTIPART_HEADER_FOLDING}, \\\nLF %{MULTIPART_LF_LINE}, \\\nSM %{MULTIPART_SEMICOLON_MISSING}, \\\nIQ %{MULTIPART_INVALID_QUOTING}, \\\nIH %{MULTIPART_INVALID_HEADER_FOLDING}, \\\nIH %{MULTIPART_FILE_LIMIT_EXCEEDED}',id:'960914',severity:2,setvar:'tx.msg=%{rule.msg}',setvar:'tx.id=%{rule.id}',tag:'RULE_MATURITY/7',tag:'RULE_ACCURACY/8',tag:'https://www.owasp.org/index.php/ModSecurity_CRS_RuleID-%{tx.id}',setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:tx.protocol_violation_score=+%{tx.critical_anomaly_score},setvar:tx.%{rule.id}-PROTOCOL_VIOLATION/INVALID_REQ-%{matched_var_name}=%{matched_var}\"\n```\n\nThe n°1 is the one always triggered. I'm not sure the n°2 is ever triggered afaik.\nYou can notice few differences between the two. The n°1 has no id and throw a status 44, and n°2 doesn't have the \"MULTIPART_INVALID_PART\".\n\nAs I have a Debian Stable server, I don't have the latest versions (modsec & rules), so maybe that's already fixed. Sorry if it's the case.\n\nlibapache2-modsecurity                        2.6.6-6+deb7u2 \nmodsecurity-crs                               2.2.5-2 \n"},"comment":{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/comments/264176719","html_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/199#issuecomment-264176719","issue_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/199","id":264176719,"user":{"login":"Cartman34","id":375425,"avatar_url":"https://avatars.githubusercontent.com/u/375425?v=3","gravatar_id":"","url":"https://api.github.com/users/Cartman34","html_url":"https://github.com/Cartman34","followers_url":"https://api.github.com/users/Cartman34/followers","following_url":"https://api.github.com/users/Cartman34/following{/other_user}","gists_url":"https://api.github.com/users/Cartman34/gists{/gist_id}","starred_url":"https://api.github.com/users/Cartman34/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Cartman34/subscriptions","organizations_url":"https://api.github.com/users/Cartman34/orgs","repos_url":"https://api.github.com/users/Cartman34/repos","events_url":"https://api.github.com/users/Cartman34/events{/privacy}","received_events_url":"https://api.github.com/users/Cartman34/received_events","type":"User","site_admin":false},"created_at":"2016-12-01T13:46:41Z","updated_at":"2016-12-01T13:46:41Z","body":"So, should I disable the rule 200003 to remove the ModSecurity recommended rule ? Everything will be ok and the system will stay protected by other rules ?\r\nI tried to get more documentation but ModSecurity and CRS things are making me crazy, I am unable to find useful informations, all of these is only made for experts."}}
{"actor":{"display_login":"Cartman34"}}