keybase / keybase/keybase-issues
Web proof is failing when server has ModSecurity with OWASP Core Rule Set
- Dominant language
- No language data
- Stars
- 899
- Forks
- 40
- PR merge metrics
- No merged PRs in 30d
Description
Keybase is unable to get keybase.txt when server uses ModSecurity with Core Rule Set.
Reason is that keybase is using GET withouth Accept header.
Related log entry:
[Thu Aug 14 08:59:12 2014] [error] [client 91.210.183.86] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/httpd/modsecurity.d/activated_rules/modsecurity_crs_21_protocol_anomalies.conf"] [line "47"] [id "960015"] [rev "1"] [msg "Request Missing an Accept Header"] [severity "NOTICE"] [ver "OWASP_CRS/2.2.6"] [maturity "9"] [accuracy "9"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_ACCEPT"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "zatko.sk"] [uri "/keybase.txt"] [unique_id "U@xeQFvStUQAAELiCLoAAAA4"]
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by tracing the request for keybase.txt and compare its headers with the ModSecurity log, especially the missing Accept header. Done when keybase.txt can be retrieved successfully from a server using the OWASP Core Rule Set.
Written by the indexing model from the issue text.
Assessment
- Domain
- security, web-dev
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100