{"action":"closed","issue":{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/1127","repository_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs","labels_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/1127/labels{/name}","comments_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/1127/comments","events_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/1127/events","html_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1127","id":332729061,"node_id":"MDU6SXNzdWUzMzI3MjkwNjE=","number":1127,"title":"tx.paranoia_level on v3/master ignored","user":{"login":"theMiddleBlue","id":4454961,"node_id":"MDQ6VXNlcjQ0NTQ5NjE=","avatar_url":"https://avatars0.githubusercontent.com/u/4454961?v=4","gravatar_id":"","url":"https://api.github.com/users/theMiddleBlue","html_url":"https://github.com/theMiddleBlue","followers_url":"https://api.github.com/users/theMiddleBlue/followers","following_url":"https://api.github.com/users/theMiddleBlue/following{/other_user}","gists_url":"https://api.github.com/users/theMiddleBlue/gists{/gist_id}","starred_url":"https://api.github.com/users/theMiddleBlue/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/theMiddleBlue/subscriptions","organizations_url":"https://api.github.com/users/theMiddleBlue/orgs","repos_url":"https://api.github.com/users/theMiddleBlue/repos","events_url":"https://api.github.com/users/theMiddleBlue/events{/privacy}","received_events_url":"https://api.github.com/users/theMiddleBlue/received_events","type":"User","site_admin":false},"labels":[{"id":970186264,"node_id":"MDU6TGFiZWw5NzAxODYyNjQ=","url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/labels/ModSec","name":"ModSec","color":"cdf91b","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":13,"created_at":"2018-06-15T10:47:26Z","updated_at":"2018-06-27T22:30:47Z","closed_at":"2018-06-27T22:30:47Z","author_association":"NONE","body":"Hi,\r\n\r\nI've an odd behavior with the last v3/master version (I've just pulled it). It seems that it ignores at all the `setvar:tx.paranoia_level=1` and it matches many rules in PL2, 3 and 4.\r\n\r\nMy configuration:\r\n```\r\nSecAction \\\r\n  \"id:900000,\\\r\n   phase:1,\\\r\n   nolog,\\\r\n   pass,\\\r\n   t:none,\\\r\n   setvar:tx.paranoia_level=1\"\r\n```\r\n\r\nAnd on audit log I've many of these (with my previous version of v3/master it wasn't happen):\r\n```\r\n{\r\n  \"details\": {\r\n    \"accuracy\": \"0\",\r\n    \"rev\": \"\",\r\n    \"ver\": \"\",\r\n    \"reference\": \"v1839,1\",\r\n    \"lineNumber\": \"18\",\r\n    \"match\": \"Matched \\\"Operator `Eq' with parameter `0' against variable `MULTIPART_UNMATCHED_BOUNDARY' (Value: `2' )\",\r\n    \"tags\": [],\r\n    \"ruleId\": \"200004\",\r\n    \"maturity\": \"0\",\r\n    \"data\": \"\",\r\n    \"severity\": \"0\",\r\n    \"file\": \"/usr/local/openresty/nginx/conf/modsecurity_config/http-www.acselspa.it/http-www.acselspa.it\"\r\n  },\r\n  \"message\": \"Multipart parser detected a possible unmatched boundary.\"\r\n},\r\n{\r\n  \"details\": {\r\n    \"accuracy\": \"9\",\r\n    \"rev\": \"2\",\r\n    \"ver\": \"OWASP_CRS/3.0.0\",\r\n    \"reference\": \"o40,1o41,1o87,1o88,1o89,1o90,1o110,1o111,1o152,1o153,1o201,1o202,1o203,1o204,1o215,1o216,1o257,1o258,1o305,1o306,1o307,1o308,1o313,1o314,1o355,1o356,1o412,1o413,1o414,1o415,1o428,1o429,1o472,1o473,1v1839,474t:urlDecodeUni\",\r\n    \"lineNumber\": \"1287\",\r\n    \"match\": \"Matched \\\"Operator `ValidadeByteRange' with parameter `32-36,38-126' against variable `REQUEST_BODY' (Value: `------WebKitFormBoundaryWWc2IeyPuspjWwJ5\\\\x0d\\\\x0aContent-Disposition: form-data; name=\\\"action\\\"\\\\x0d\\\\x0 (476 characters omitted)' )\",\r\n    \"tags\": [\r\n      \"application-multi\",\r\n      \"language-multi\",\r\n      \"platform-multi\",\r\n      \"attack-protocol\",\r\n      \"OWASP_CRS/PROTOCOL_VIOLATION/EVASION\",\r\n      \"paranoia-level/3\"\r\n    ],\r\n    \"ruleId\": \"920272\",\r\n    \"maturity\": \"9\",\r\n    \"data\": \"\",\r\n    \"severity\": \"2\",\r\n    \"file\": \"/usr/local/openresty/nginx/conf/owasp-modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf\"\r\n  },\r\n  \"message\": \"Invalid character in request (outside of printable chars below ascii 127)\"\r\n},\r\n{\r\n  \"details\": {\r\n    \"accuracy\": \"9\",\r\n    \"rev\": \"2\",\r\n    \"ver\": \"OWASP_CRS/3.0.0\",\r\n    \"reference\": \"o40,1o41,1o62,1o72,1o73,1o79,1o86,1o87,1o88,1o89,1o90,1o110,1o111,1o152,1o153,1o174,1o184,1o185,1o191,1o200,1o201,1o202,1o203,1o204,1o215,1o216,1o257,1o258,1o279,1o289,1o290,1o296,1o304,1o305,1o306,1o307,1o308,1o313,1o314,1o355,1o356,1o377,1o387,1o388,1o394,1o411,1o412,1o413,1o414,1o415,1o428,1o429,1o472,1o473,1v1839,474t:urlDecodeUni\",\r\n    \"lineNumber\": \"1348\",\r\n    \"match\": \"Matched \\\"Operator `ValidadeByteRange' with parameter `38,44-46,48-58,61,65-90,95,97-122' against variable `REQUEST_BODY' (Value: `------WebKitFormBoundaryWWc2IeyPuspjWwJ5\\\\x0d\\\\x0aContent-Disposition: form-data; name=\\\"action\\\"\\\\x0d\\\\x0 (476 characters omitted)' )\",\r\n    \"tags\": [\r\n      \"application-multi\",\r\n      \"language-multi\",\r\n      \"platform-multi\",\r\n      \"attack-protocol\",\r\n      \"OWASP_CRS/PROTOCOL_VIOLATION/EVASION\",\r\n      \"paranoia-level/4\"\r\n    ],\r\n    \"ruleId\": \"920273\",\r\n    \"maturity\": \"9\",\r\n    \"data\": \"\",\r\n    \"severity\": \"2\",\r\n    \"file\": \"/usr/local/openresty/nginx/conf/owasp-modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf\"\r\n  },\r\n  \"message\": \"Invalid character in request (outside of very strict set)\"\r\n},\r\n{\r\n  \"details\": {\r\n    \"accuracy\": \"8\",\r\n    \"rev\": \"2\",\r\n    \"ver\": \"OWASP_CRS/3.0.0\",\r\n    \"reference\": \"o2,8o2,8v1931,19t:urlDecodeUni\",\r\n    \"lineNumber\": \"1251\",\r\n    \"match\": \"Matched \\\"Operator `Rx' with parameter `((?:[\\\\~\\\\!\\\\@\\\\#\\\\$\\\\%\\\\^\\\\&\\\\*\\\\(\\\\)\\\\-\\\\+\\\\=\\\\{\\\\}\\\\[\\\\]\\\\|\\\\:\\\\;\\\\\\\"\\\\'\\\\Â´\\\\â\\\\â\\\\`\\\\<\\\\>][^\\\\~\\\\!\\\\@\\\\#\\\\$\\\\%\\\\^\\\\&\\\\*\\\\(\\\\)\\\\-\\\\+\\\\=\\\\{\\\\}\\\\[\\\\]\\\\|\\\\:\\\\;\\\\\\\"\\\\'\\\\Â´\\\\â\\\\â\\\\`\\\\<\\\\>]*?){2})' against variable `ARGS:action' (Value: `wp-remove-post-lock' )\",\r\n    \"tags\": [\r\n      \"application-multi\",\r\n      \"language-multi\",\r\n      \"platform-multi\",\r\n      \"attack-sqli\",\r\n      \"OWASP_CRS/WEB_ATTACK/SQL_INJECTION\",\r\n      \"WASCTC/WASC-19\",\r\n      \"OWASP_TOP_10/A1\",\r\n      \"OWASP_AppSensor/CIE1\",\r\n      \"PCI/6.5.2\",\r\n      \"paranoia-level/4\"\r\n    ],\r\n    \"ruleId\": \"942432\",\r\n    \"maturity\": \"9\",\r\n    \"data\": \"Matched Data: -remove- found within ARGS:action: wp-remove-post-lock\",\r\n    \"severity\": \"4\",\r\n    \"file\": \"/usr/local/openresty/nginx/conf/owasp-modsecurity-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf\"\r\n  },\r\n  \"message\": \"Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (2)\"\r\n}\r\n```\r\n\r\nAny idea? how can I do for pull the previous version of v3/master?\r\n\r\nThanks!"}}
{"actor":{"display_login":"csanders-git"}}