{"action":"created","issue":{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/373","repository_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs","labels_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/373/labels{/name}","comments_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/373/comments","events_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/373/events","html_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/373","id":161986906,"number":373,"title":"CRS 3.0-Rc1 - 920430 & 911100 triggered on lots of requests","user":{"login":"quenenni","id":3638408,"avatar_url":"https://avatars.githubusercontent.com/u/3638408?v=3","gravatar_id":"","url":"https://api.github.com/users/quenenni","html_url":"https://github.com/quenenni","followers_url":"https://api.github.com/users/quenenni/followers","following_url":"https://api.github.com/users/quenenni/following{/other_user}","gists_url":"https://api.github.com/users/quenenni/gists{/gist_id}","starred_url":"https://api.github.com/users/quenenni/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/quenenni/subscriptions","organizations_url":"https://api.github.com/users/quenenni/orgs","repos_url":"https://api.github.com/users/quenenni/repos","events_url":"https://api.github.com/users/quenenni/events{/privacy}","received_events_url":"https://api.github.com/users/quenenni/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2016-06-23T18:09:03Z","updated_at":"2016-06-27T16:32:26Z","closed_at":null,"body":"Server: Debian Wheezy\r\nPHP Version 5.4.45-0+deb7u3\r\nApache-npm-itk v2.2.22\r\nlibapache2-mod-security2: v2.8.0-2~bpo70+1\r\nModsec Crs:  v3.0.0-rc1\r\n\r\n-----------------------\r\n\r\nThis new Crs version looks very promising. Thanks a lot for all this.\r\n\r\nI have 2 warnings triggered on nearly all the requests, simple GET requests.. \r\n\r\nIt seems the values from the variables defined in rule id 900012 are not well checked:\r\n```\r\nSecAction \\\r\n \"id:'900012',\\\r\n  phase:request,\\\r\n  nolog,\\\r\n  pass,\\\r\n  t:none,\\\r\n  setvar:'tx.allowed_methods=GET HEAD POST OPTIONS', \\\r\n  setvar:'tx.static_resources=jpg|jpeg|png|gif|js|css|ico', \\\r\n  setvar:'tx.allowed_request_content_type=application/x-www-form-urlencoded|multipart/form-data|text/xml|application/xml|application/x-amf|application/json|text/plain', \\\r\n  setvar:'tx.allowed_http_versions=HTTP/0.9 HTTP/1.0 HTTP/1.1', \\\r\n  setvar:'tx.restricted_extensions=.asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .resources/ .resx/ .sql/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/', \\\r\n  setvar:'tx.restricted_headers=/Proxy-Connection/ /Lock-Token/ /Content-Range/ /Translate/ /via/ /if/'\"\r\n```\r\n\r\nThe warnings I have don't make sense:\r\n```\r\nWarning. Match of \"within %{tx.allowed_methods}\" against \"REQUEST_METHOD\" required. [file \"/etc/modsecurity/REQUEST-11-METHOD-ENFORCEMENT.conf\"] [line \"49\"] [id \"911100\"] [rev \"2\"] [msg \"Method is not allowed by policy\"] [data \"GET\"] ...\r\n\r\nRuel id 911100 (rules/REQUEST-11-METHOD-ENFORCEMENT.conf):\r\nSecRule REQUEST_METHOD \"!@within %{tx.allowed_methods}\"\r\n```\r\nGET is in the \"allowed_methods\".\r\n```\r\nMessage: Warning. Match of \"within %{tx.allowed_http_versions}\" against \"REQUEST_PROTOCOL\" required. [file \"/etc/modsecurity/REQUEST-20-PROTOCOL-ENFORCEMENT.conf\"] [line \"1051\"] [id \"920430\"] [rev \"2\"] [msg \"HTTP protocol version is not allowed by policy\"] [data \"HTTP/1.1\"] ...\r\n\r\nRule id 920430 (rules/REQUEST-20-PROTOCOL-ENFORCEMENT.conf):\r\nSecRule REQUEST_PROTOCOL \"!@within %{tx.allowed_http_versions}\"\r\n```\r\nHTTP/1.1 is in the \"allowed_http_versions\"\r\n\r\nIs there a problem with the function 'within'?\r\n\r\nSee attached log for more info.\r\n\r\n[event_28683.txt](https://github.com/SpiderLabs/owasp-modsecurity-crs/files/330538/event_28683.txt)\r\n"},"comment":{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/comments/228799771","html_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/373#issuecomment-228799771","issue_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/373","id":228799771,"user":{"login":"quenenni","id":3638408,"avatar_url":"https://avatars.githubusercontent.com/u/3638408?v=3","gravatar_id":"","url":"https://api.github.com/users/quenenni","html_url":"https://github.com/quenenni","followers_url":"https://api.github.com/users/quenenni/followers","following_url":"https://api.github.com/users/quenenni/following{/other_user}","gists_url":"https://api.github.com/users/quenenni/gists{/gist_id}","starred_url":"https://api.github.com/users/quenenni/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/quenenni/subscriptions","organizations_url":"https://api.github.com/users/quenenni/orgs","repos_url":"https://api.github.com/users/quenenni/repos","events_url":"https://api.github.com/users/quenenni/events{/privacy}","received_events_url":"https://api.github.com/users/quenenni/received_events","type":"User","site_admin":false},"created_at":"2016-06-27T16:32:26Z","updated_at":"2016-06-27T16:32:26Z","body":"> Also, how are you including the setup.conf and the CRS rules? Are you including the setup.conf first from your httpd.conf, and then the CRS rules? (We should definitely document this better)\r\n\r\nThe file '/etc/apache2/mods-enabled/security2.conf' contains:\r\n`\r\n<IfModule security2_module>\r\n        # Default Debian dir for modsecurity's persistent data\r\n        SecDataDir /var/cache/modsecurity\r\n\r\n        # Include all the *.conf files in /etc/modsecurity.\r\n        # Keeping your local configuration in that directory\r\n        # will allow for an easy upgrade of THIS file and\r\n        # make your life easier\r\n        Include /etc/modsecurity/*.conf\r\n</IfModule>\r\n`\r\n\r\nFrom what I understand, the files are charged in alphabetic order and modsecurity.conf is the first conf file loaded, then modsecurity_crs_10_setup.conf, then all the REQUEST-* conf files and then the RESPONSE-* conf files."}}
{"actor":{"display_login":"quenenni"}}