coreruleset / coreruleset/coreruleset
False positive of rule 932125 and 932235 for mountain names
Open
Nobody has claimed this yet.
:heavy_plus_sign: False Positive
- Dominant language
- Python
- Stars
- 3.3k
- Forks
- 470
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 11
Description
Description
False positive of rule 932125 and 932235 triggered by "& Mount Davis" in string. The following is a description about a arieal photo. FYI Mount Davis is a hill in Hong Kong.
In the extreme, this rule would also be triggered by "& Mount Everest" and a lot of mountains.
How to reproduce the misbehavior (-> curl call)
curl https://example.com/anything -H "Content-Type: application/json; charset=utf-8" -d '[{"JobDescription": "Take aerial photo for potential landslides at Queen Mary Hospital Mount Davis"}, {"JobDescription": "Take aerial photo for potential landslides at Queen Mary Hospital & Mount Davis"}]'
Logs
[28/Jan/2026:23:26:51 +0800] 176961401167.063209 127.0.0.1 33388 127.0.0.1 443
---3Ggvqn5n---B--
POST /anything HTTP/2.0
host: example.com
user-agent: curl/8.5.0
accept: */*
content-type: application/json; charset=utf-8
content-length: 204
---3Ggvqn5n---D--
---3Ggvqn5n---E--
<html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx/1.26.2</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a
---3Ggvqn5n---F--
HTTP/2.0 403
Server: nginx/1.26.2
Date: Wed, 28 Jan 2026 15:26:51 GMT
Content-Length: 153
Content-Type: text/html
Connection: close
---3Ggvqn5n---H--
ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:b[\"'\)\[\x5c]*(?:(?:(?:\|\||&&)[\s\x0b]*)?\$[!#\(\*\-0-9\?@_a-\{]*)?\x5c?u[\"'\)\[\x5c]*(?:(?:(?:\|\||&&)[\s\x0b]*)?\$[!#\(\*\-0-9\?@_a-\{]*)?\x5c?s[\"'\)\[\x5c]*(?:(?:(?:\|\||&&)[\s\x0b]*)?\$ (9601 characters omitted)' against variable `ARGS:json.array_1.JobDescription' (Value: `Take aerial photo for potential landslides at Queen Mary Hospital & Mount Davis' ) [file "/opt/crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "182"] [id "932235"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: & Mount found within ARGS:json.array_1.JobDescription: Take aerial photo for potential landslides at Queen Mary Hospital & Mount Davis"] [severity "2"] [ver "OWASP_CRS/4.21.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/ATTACK-RCE"] [tag "capec/1000/152/248/88"] [hostname "127.0.0.1"] [uri "/anything"] [unique_id "176961401167.063209"] [ref "o66,8v28,79"]
ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:[\n\r;`\{]|\|\|?|&&?)[\s\x0b]*[\s\x0b\"'\(,@]*(?:[\"'\.-9A-Z_a-z]+/|(?:[\"'\x5c\^]*[0-9A-Z_a-z][\"'\x5c\^]*:.*|[ \"'\.-9A-Z\x5c\^_a-z]*)\x5c)?[\"\^]*(?:(?:a[\"\^]*(?:c|s[\"\^]*n[\"\^]*p)|e[\"\^ (1741 characters omitted)' against variable `ARGS:json.array_1.JobDescription' (Value: `Take aerial photo for potential landslides at Queen Mary Hospital & Mount Davis' ) [file "/opt/crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "249"] [id "932125"] [rev ""] [msg "Remote Command Execution: Windows Powershell Alias Command Injection"] [data "Matched Data: & Mount Davis found within ARGS:json.array_1.JobDescription: Take aerial photo for potential landslides at Queen Mary Hospital & Mount Davis"] [severity "2"] [ver "OWASP_CRS/4.21.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/ATTACK-RCE"] [tag "capec/1000/152/248/88"] [hostname "127.0.0.1"] [uri "/anything"] [unique_id "176961401167.063209"] [ref "o66,13v28,79"]
ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `10' ) [file "/opt/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "222"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.21.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "127.0.0.1"] [uri "/anything"] [unique_id "176961401167.063209"] [ref ""]
---3Ggvqn5n---I--
---3Ggvqn5n---J--
---3Ggvqn5n---Z--
---k5SirQS7---Z--
Your Environment
- CRS version (e.g., v3.3.4): 4.21.0
- Paranoia level setting (e.g. PL1) : PL1
- ModSecurity version (e.g., 2.9.6): 3.0.14
- Web Server and version or cloud provider / CDN (e.g., Apache httpd 2.4.54): nginx 1.26.2
- Operating System and version: ubuntu 24.04
Confirmation
[X] I have removed any personal data (email addresses, IP addresses,
passwords, domain names) from any logs posted.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with REQUEST-932-APPLICATION-ATTACK-RCE.conf, especially the rules at lines 182 and 249 for IDs 932235 and 932125, then reproduce the report with its curl request. Done means benign strings such as "& Mount Davis" no longer trigger those rules while command-injection detection remains covered.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- nginx
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100