coreruleset / coreruleset/modsecurity-crs-docker
Basic modsecurity setup with nginx docker image responds with HTML content but with content-type of text/plain
Nobody has claimed this yet.
- Dominant language
- Dockerfile
- Stars
- 448
- Forks
- 88
- Avg merge
- 6m
- Merged PRs (30d)
- 2
Description
When testing out the basic features of modsecurity, I tried accessing a non-existing page which is included by threat scanning tools to see how modsecurity would handle it. I was happy to see that the request resulted in a generic 403 response but instead of the HTML rendering in the browser it was displayed in plain text. When checking, it looks like the content-type of the response was text/plain when it really should have been text/html.
Additionally, the server header in the response was disclosing that the underlying system was using nginx which is a concern due to disclosure of the underlying technology, and which allows attackers narrow their possible set of attacks. In the same way, the default 403 error message show below also references nginx. My recommendation, if possible, would be to configure this product to remove these headers and to use something generic which does not signal anything unique to clue an attacker in on the use of modsecurity or nginx.
Image: owasp/modsecurity-crs:nginx
Example URL: http://localhost:8080/.env
Response:
<html>
<head><title>403 Forbidden</title></head>
<body>
<center><h1>403 Forbidden</h1></center>
<hr><center>nginx</center>
</body>
</html>
<!-- a padding to disable MSIE and Chrome friendly error page -->
<!-- a padding to disable MSIE and Chrome friendly error page -->
<!-- a padding to disable MSIE and Chrome friendly error page -->
<!-- a padding to disable MSIE and Chrome friendly error page -->
<!-- a padding to disable MSIE and Chrome friendly error page -->
<!-- a padding to disable MSIE and Chrome friendly error page -->
I had brought this up originally at https://github.com/owasp-modsecurity/ModSecurity-nginx/issues/362#issuecomment-3352888117.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file or test is named. Reproduce the response using the owasp/modsecurity-crs:nginx image and the /.env example URL, then inspect the image's nginx configuration and error handling; done means the 403 response renders as HTML without disclosing nginx or ModSecurity-specific details.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, nginx
- Domain
- infrastructure, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100