{"action":"created","issue":{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/366","repository_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs","labels_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/366/labels{/name}","comments_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/366/comments","events_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/366/events","html_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/366","id":160866558,"number":366,"title":"Rule 920310 (CRS3): False positive on exotic UA","user":{"login":"dune73","id":618722,"avatar_url":"https://avatars.githubusercontent.com/u/618722?v=3","gravatar_id":"","url":"https://api.github.com/users/dune73","html_url":"https://github.com/dune73","followers_url":"https://api.github.com/users/dune73/followers","following_url":"https://api.github.com/users/dune73/following{/other_user}","gists_url":"https://api.github.com/users/dune73/gists{/gist_id}","starred_url":"https://api.github.com/users/dune73/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dune73/subscriptions","organizations_url":"https://api.github.com/users/dune73/orgs","repos_url":"https://api.github.com/users/dune73/repos","events_url":"https://api.github.com/users/dune73/events{/privacy}","received_events_url":"https://api.github.com/users/dune73/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/labels/V3.0.0-rc1%20Development","name":"V3.0.0-rc1 Development","color":"bfe5bf"},{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/labels/v3.0.0-rc1%20Paranoid","name":"v3.0.0-rc1 Paranoid","color":"bfdadc"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-06-17T11:19:28Z","updated_at":"2016-06-17T12:34:59Z","closed_at":null,"body":"The rule 920310 (CRS3) checks for empty Accept Header.\r\n\r\nI am seeing now empty accept headers in production from an exotic probably ms-exchange-related user-agent::\r\n```\r\nEntreprise/6.5.0.177 CFNetwork/758.4.3 Darwin/15.5.0\r\n```\r\nIt's a GET for /autodiscover/autodiscover.xml. I do not really know what this is all about, nor do I know the UA nor it's components (well, outside of Darwin, obviously).\r\n\r\nThe rule contains a chain and has a pmf operator to avoid false positives. The pmf checks for AppleWebKit and Android right now.\r\n\r\nPossible solution:\r\n- Move rule to higher paranoia level (Maybe it's overkill for PL 1)\r\n- Add string to pmf: probably \"CFNetwork\" and not \"Entreprise\" as it comes with a typo, which could be fixed anytime and because Enterprise is a very broad term (unlike CFNetwork).\r\n\r\nThoughts?\r\n"},"comment":{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/comments/226757389","html_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/366#issuecomment-226757389","issue_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/366","id":226757389,"user":{"login":"csanders-git","id":4632287,"avatar_url":"https://avatars.githubusercontent.com/u/4632287?v=3","gravatar_id":"","url":"https://api.github.com/users/csanders-git","html_url":"https://github.com/csanders-git","followers_url":"https://api.github.com/users/csanders-git/followers","following_url":"https://api.github.com/users/csanders-git/following{/other_user}","gists_url":"https://api.github.com/users/csanders-git/gists{/gist_id}","starred_url":"https://api.github.com/users/csanders-git/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/csanders-git/subscriptions","organizations_url":"https://api.github.com/users/csanders-git/orgs","repos_url":"https://api.github.com/users/csanders-git/repos","events_url":"https://api.github.com/users/csanders-git/events{/privacy}","received_events_url":"https://api.github.com/users/csanders-git/received_events","type":"User","site_admin":false},"created_at":"2016-06-17T12:34:59Z","updated_at":"2016-06-17T12:34:59Z","body":"It seems like it has something to do with apples network abstraction library. Is this coming from an IOS device? While it is a false positive is it something that warrants adding a modification to the rules for?"}}
{"actor":{"display_login":"csanders-git"}}